Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0 Firefox ESR 24.x before 24.2 Thunderbird before 24.2 and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving synthetic mouse movement related to the RestyleManager::GetHoverGeneration function.