Technical impact
Based on the description, it is inferred that a use‑after‑free bug in Mozilla Firefox’s JavaScript WebAssembly component allows an attacker to reference memory that has already been freed, potentially corrupting the execution flow of the browser. If triggered by malicious WebAssembly code embedded in a web page, the flaw can lead to arbitrary code execution or memory corruption, compromising the confidentiality, integrity or availability of the affected user’s system.
Affected Systems
Mozilla Firefox. All versions released before 150.0.3 are affected; the vulnerability was addressed in Firefox 150.0.3 and later.
Risk and Exploitability
The CVSS score is 7.3 and the EPSS score is < 1%, indicating a very low probability of exploitation in current real‑world scenarios. The vulnerability is not listed in CISA KEV. While the use‑after‑free flaw can enable arbitrary code execution if triggered by malicious WebAssembly code, the low EPSS suggests that exploitation is unlikely at present, yet the potential impact remains high, warranting prompt mitigation.
