A use‑after‑free flaw, categorized as CWE-416 and CWE-825, exists in the DOM: Bindings (WebIDL) component used by Mozilla’s browser and mail applications. When the engine releases memory tied to a WebIDL object while a reference to that memory still exists, the flaw can corrupt that memory or, potentially, allow arbitrary code execution. The CVE description does not detail the exact consequence, but the nature of the flaw indicates that memory corruption is the core impact.

Mozilla Firefox releases older than 151, older Firefox ESR builds before ESR 115.36 and ESR 140.11, and all Thunderbird releases older than 151 or before ESR 140.11 contain the vulnerability. Any newer release of these products removes the flaw.

The CVSS score is 7.3, indicating significant potential impact. The EPSS score of 0.00049 (less than 0.1%) indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, so no widespread exploitation has been documented. The attack vector is not explicitly defined in the description; however, the typical scenario for use‑after‑free flaws in the browser would involve malicious web content processed by the renderer. Because the flaw can corrupt memory, it presents a high risk if an attacker can deliver suitable input.