A vulnerable object in the browser’s core and HTML handling layer can be freed before all references are released, creating a use‑after‑free scenario. If exploited, an attacker could trigger a crash or potentially execute arbitrary code with the privileges of the browser process. The weakness stems from improper memory management in the DOM parsing engine, classifying it as a classic use‑after‑free flaw.

Mozilla Firefox users running any release prior to 155 or the ESR build before 153.2 are affected. The issue exists in the core DOM and HTML components, and is fixed in Firefox 155 and Firefox ESR 153.2.

The vulnerability carries a high potential for exploitation, though no EPSS score is published and it is not currently in the CISA KEV catalog. Typical use‑after‑free flaws can be triggered via crafted web content or malicious extensions, implying a remote attack vector, with the attacker only requiring the victim to visit a specialized page or run a compromised add‑on. The absence of an EPSS value suggests limited publicly known exploits, but the inherent severity warrants prompt action.