Sandbox escape due to use‑after‑free in the Disability Access APIs component allows an attacker to break out of the browser sandbox and execute arbitrary code. The vulnerability arises when the component accesses memory that has already been freed, creating an unintended reference that can be exploited to bypass sandbox enforcement. This bug corresponds to CWE‑416 and also involves CWE‑825, which concerns improper handling of the accessibility API. The impact is that code can run with the privileges of the browser process, potentially enabling access to sensitive local data or system resources.

The vulnerability affects Mozilla Firefox on all releases prior to Firefox 151. Firefox ESR 115.36 and ESR 140.11 are already fixed. Users of these versions should consider them exposed until the update is applied. Thunderbird users on versions prior to Thunderbird 151 and Thunderbird 140.11 are also affected until those releases are installed.

The CVSS score is 9.6, indicating critical severity. Official advisories indicate the issue was addressed in the aforementioned releases and there is no current listing in the CISA KEV catalog. The EPSS score is 0.00043, indicating an extremely low but non‑zero exploitation probability. The likely attack vector is local, requiring an ability to trigger the Disability Access APIs—such as from malicious web content or a compromised accessibility service. Given the lack of public exploitation reports, the current risk remains uncertain but is mitigated by applying the vendor‑supplied patch.