This vulnerability comprises multiple memory safety bugs in Mozilla Firefox and Thunderbird versions prior to Firefox 149 and ESR releases 115.34 and 140.9. These bugs include use-after-free, incorrect boundary conditions, integer overflows, race conditions, and sandbox escapes across various components such as Graphics, JavaScript engine, CSS parsing, and Audio/Video subsystems. The memory corruption issues could be leveraged to execute arbitrary code remotely without user interaction or privileges. Mozilla has released official patches in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9 to address these vulnerabilities.

Successful exploitation of these memory safety bugs could allow remote attackers to execute arbitrary code on affected systems, potentially leading to full compromise of the browser or email client. The vulnerability affects confidentiality, integrity, and availability of the affected products. There are no known exploits in the wild at the time of publication, but the critical CVSS score reflects the high potential impact if exploited.

Official patches are available and have been released by Mozilla in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these fixed versions immediately to mitigate the risk. No additional mitigations are specified by the vendor advisory beyond applying these updates.