This vulnerability stems from a use‑after‑free object in the browser’s DOM handling. When the garbage collector reclaims memory that is still being referenced, an attacker can manipulate the freed region to override normal control flow and escape the sandbox. The result is that malicious code can execute with elevated privileges inside the browser process, potentially compromising the host system. The primary weakness is a memory safety flaw that allows arbitrary code execution.

The defect impacts Mozilla Firefox releases prior to the patch. The fix was applied in Firefox 155 and in the ESR lines 115.40, 140.15, and 153.2. Any installation of Firefox or a supported ESR channel with a version earlier than these is considered vulnerable. The issue is limited to the Firefox product and does not affect other Mozilla browsers such as Thunderbird or SeaMonkey.

Because the flaw permits sandbox escape, the risk level is high if the browser processes untrusted web content or extensions. The exploration of the exploit space is likely via a malicious web page or compromised extension that triggers the use‑after‑free. While official EPSS data are currently unavailable and the vulnerability is not listed in CISA’s KEV catalog, its severity is inferred to be high due to the ability to hijack browser memory and execute arbitrary code. No public exploit is known, but the attack vector is inferred to be remote, initiated by a crafted web page or extension.