Mozilla Firefox and Thunderbird contain a critical use-after-free vulnerability in the JavaScript engine that could lead to arbitrary code execution if a user visits a malicious website.

This is a use-after-free vulnerability residing in the Just-In-Time (JIT) compiler of the JavaScript engine. An unauthenticated remote attacker can trigger this flaw by enticing a user to navigate to a specially crafted web page.

Successful exploitation of this vulnerability allows an attacker to achieve code execution with the privileges of the user running the browser or mail client. Given the CVSS score of 8.8, this poses a high risk to organizational data confidentiality, integrity, and availability, as it could facilitate malware installation, data exfiltration, or complete system compromise.

Immediate Action: Update all installations of Mozilla Firefox and Thunderbird to version 140.16 or later immediately.

Proactive Monitoring: Monitor endpoint security logs for unusual process spawning originating from the browser or email client executable.

Compensating Controls: Ensure that browser security settings are configured to disable advanced JIT features where business requirements permit, or utilize endpoint protection software that detects memory corruption patterns.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability, combined with its potential for remote code execution, necessitates immediate patching. Organizations should prioritize deploying the 140.16 update across all workstations to mitigate the risk of browser-based exploitation.