The vulnerability is a race condition in nsHttpTransaction, a component that handles HTTP requests in the browser. The flaw allows concurrent transactions to interfere with each other, corrupting the memory region that stores response data. This memory corruption can result in unexpected application behavior, including crashes or the corruption of data stored in the browser. The description does not confirm arbitrary code execution, so the impact is limited to instability and potential data integrity issues.

Any Mozilla Firefox installation using a version earlier than 137.0.2 is susceptible. Versions 137.0.2 and later include the fix that removes the flawed synchronization.

The CVSS score of 6.5 indicates medium severity. With an EPSS score of less than 1%, the probability of exploitation in the wild is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is browser‑based and requires an attacker to deliver malicious web content that triggers the race condition, as inferred from the requirement of concurrent HTTP transactions.