The vulnerability resides in the Service Workers component of the browser’s Document Object Model (DOM) implementation. It can be triggered by malicious content that exploits the component’s resource handling, leading to a denial of service where the browser becomes unresponsive and users are unable to interact with web content or the application itself.

Mozilla Firefox and Mozilla Thunderbird are impacted. All versions prior to Firefox 147 and Thunderbird 147 are vulnerable, as the issue was fixed in these releases. Any installation of earlier versions that still contain the original Service Workers implementation is at risk.

The CVSS score of 7.5 indicates high severity, but the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a malicious website or script that registers a Service Worker to exhaust resources or repeatedly manipulate the DOM, causing the browser to freeze. The attack would typically require a user to visit or interact with such content, and does not appear to allow remote code execution or privilege escalation beyond the affected application.