A miscompilation fault in the JavaScript engine’s JIT component allows an attacker who can deliver malicious JavaScript to cause the engine to execute native code, leading to remote code execution. The flaw is classified as critical, with a CVSS score of 9.8, indicating that a successful exploit could compromise system confidentiality, integrity, and availability.

Mozilla releases indicate that all Firefox and Thunderbird versions older than 145 are affected. Thus, users running any pre‑145 build of either product are at risk until the update is applied. No more specific sub‑version details are provided, so the entire pre‑145 set should be considered vulnerable.

The EPSS score is reported as less than 1%, implying that currently, exploitation attempts are rare or in testing stages. Nevertheless, the high CVSS rating signals a potentially catastrophic impact if the vulnerability is leveraged. The security community has not yet catalogued the flaw in CISA’s KEV list, but this does not reduce the need for remediation. The most likely attack vector is through a malicious web page or compromised attachment that loads JavaScript in the browser, which then triggers the miscompilation. Attackers could achieve full system compromise without the need for privilege escalation beyond the user running the vulnerable application.