A use-after-free issue exists due to improper memory management. This flaw can be triggered when processing maliciously crafted web content, potentially leading to an unexpected browser crash. In specific environments, such as the PlayStation 5, this can be exploited via a reentrant use-after-free in the `getContext()` function of the HTML5 `<canvas>` element. By using a JavaScript getter within the options of `getContext('bitmaprenderer', opts)`, an attacker can cause the system to free a 768-byte 2D context while a JavaScript wrapper remains resident, creating a dangling pointer. This allows for bidirectional memory aliasing, enabling an attacker to read and write state properties such as `lineWidth`, `miterLimit`, `globalAlpha`, `fillStyle`, and `transform`. Additionally, in WebKitGTK, this and related security issues could allow a remote attacker to perform cross-site scripting (XSS), denial of service (DoS), and arbitrary code execution if a user is tricked into visiting a malicious website.