A use-after-free vulnerability exists in Firefox and Thunderbird due to crafted XSLT data, which can lead to a potentially exploitable crash. This issue affects Firefox versions prior to 135, Firefox ESR versions prior to 115.20 and 128.7, and Thunderbird versions prior to 128.7 and 135. The vulnerability was reported by Ivan Fratric of Google Project Zero and is classified as critical with a CVSS score of 9.8. Mozilla has released fixes for this vulnerability in Firefox 135, Firefox ESR 115.20 and 128.7, and Thunderbird 135 and 128.7.