CVE-2015-2731

CVE-2015-2731 is a critical use-after-free vulnerability in the CSPService::ShouldLoad function within Mozilla Firefox before version 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1. This flaw allows remote attackers to execute arbitrary code by manipulating client-side JavaScript to remove a DOM object based on a Content Policy. With a CVSS score of 10.0, it represents a severe risk, indicating a network-exploitable vulnerability with low attack complexity that can lead to complete compromise of confidentiality, integrity, and availability. While the vulnerability received some media coverage and community discussion at the time, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB.