This vulnerability stems from a use‑after‑free object in the browser’s DOM handling. When the garbage collector reclaims memory that is still being referenced, an attacker can manipulate the freed region to override normal control flow and escape the sandbox. The result is that malicious the host system. The primary weakness is a memory safety flaw that allows arbitrary code execution.

The defect impacts Mozilla Firefox releases prior to the patch. The fix was applied in Firefox 155 and in the ESR lines 115.40, 140.15, and 153.2. Any installation of Firefox or a supported ESR channel with a version earlier than these is considered vulnerable. The issue also affects Mozilla Thunderbird releases prior to the patch, with the fix applied in Thunderbird 155 and153.2. Any installation of Thunderbird or a supported ESR channel with a version earlier than these is considered vulnerable.

Because the flaw permits sandbox escape, the risk level is high if the browser processes untrusted web content or extensions. The likely attack vector is a malicious web page or compromised extension that triggers the use‑after‑free. The EPSS score is less than 1 %, indicating a low probability of active exploitation, but the CVSS score of 9.6 highlights critical severity due to the ability to hijack browser memory and execute arbitrary code. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is known at this time.