Use‑after‑free in the DOM networking component is a memory‑management flaw (CWE‑416) combined with improper handling of reference‑counted objects (CWE‑825) that can be triggered by malformed network traffic. The defect permits an attacker to dereference freed memory, which may lead to memory corruption and, in some scenarios, arbitrary code execution. The description does not specify a confirmed exploitation path, but the nature of this use‑after‑free vulnerability indicates a significant risk if exploited.

All Mozilla Firefox builds before version 150.0.2, including the ESR 140.10.2 and ESR 115.35.2 releases, as well as all Thunderbird builds before 150.0.2 and the ESR 140.10.2 version, are vulnerable. Users running any of these versions are affected until they upgrade to the patched releases.

The EPSS score is below 1%, indicating a very low exploitation probability, and the issue is not catalogued in the CISA KEV list, meaning there is no publicly known exploitation. The CVSS score of 7.3 places the vulnerability in the high severity range. While the primary attack vector is likely network traffic from a malicious web page, the precise exploitation conditions are not detailed in the CVE text; this inference is based on the general characteristics of the flaw rather than explicit documentation.