This vulnerability is a type confusion (CWE‑843) caused by miscompilation in the JavaScript engine’s JIT layer. The faulty compilation can cause the browser to generate incorrect native code from JavaScript bytecode, giving arbitrary instructions in the context of the browser process and potentially compromising the user’s system.

Mozilla Firefox and Thunderbird users running versions prior to 157 are affected, as the issue was remediated in Firefox 157. The ground truth for specific obsolete sub‑versions is not listed, but any release before 157 inherits the vulnerability.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is less than 1%, showing a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of malicious or specially crafted JavaScript that the victim’s browser will execute, leading to arbitrary code execution. With no mitigation other than updating, this poses significant risk to users who load untrusted web content.