A miscompilation in Mozilla Firefox’s JavaScript engine JIT component causes the engine to generate incorrect bytecode. This miscompilation can lead to arbitrary code execution if an attacker supplies specially crafted JavaScript that is executed by the victim’s browser. The weakness is classified as a code injection flaw (CWE‑94) and provides the attacker with the ability to compromise confidentiality, integrity, and availability on vulnerable systems.

All Mozilla Firefox browsers built prior to version 143.0.3 are susceptible, regardless of operating system. The bug affects the JavaScript engine that runs in user‑process browsers, so any platform that ships the unpatched Firefox executable is impacted.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at present, and the vulnerability is not listed in CISA KEV. Based on the description, the attacker would need to deliver malicious JavaScript to a user’s browser; the most straightforward attack vector appears to be via a compromised or malicious website or email attachment that triggers the JIT compilation process. The exact conditions required for exploitation are not fully detailed, so the risk is considered moderate due to the high severity combined with the low EPSS probability.