This vulnerability involves a use-after-free condition in the JavaScript GC component of Mozilla Firefox, identified as CVE-2026-0885. Use-after-free bugs occur when a program continues to use memory after it has been freed, potentially leading to memory corruption. Mozilla fixed this vulnerability in Firefox 147 and Firefox ESR 140.7, along with Thunderbird 147 and Thunderbird ESR 140.7. The CVSS v3.1 base score is 6.5 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and availability impact. The vendor advisory lists this vulnerability among several memory safety bugs fixed in these releases.

The vulnerability could allow an attacker to cause memory corruption through a use-after-free in the JavaScript GC component, potentially impacting confidentiality and availability. However, there is no evidence of exploitation in the wild. The impact is rated moderate by Mozilla and the CVSS score reflects a medium severity level.

A fix for this vulnerability is available and has been incorporated in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. Users and administrators should update to these versions or later to remediate this issue. No additional mitigation actions are required beyond applying the official updates.