The vulnerability resides in the JavaScript engine’s JIT component of Mozilla Firefox. A miscompilation in the JIT can cause the engine to generate incorrect machine code from malicious JavaScript, enabling an attacker with a web page that runs in the browser to execute arbitrary code at the privileges of the browser process. This constitutes an untrusted code execution flaw, categorised as CWE‑1021, and can compromise confidentiality, integrity, and availability of the user’s system.

Any Firefox installation that has not applied the fix released in version 151.0.3 is vulnerable. The fix was first introduced in the 2026 release series, so older releases such as 151.0, 150.x and earlier are susceptible. The affected product is Mozilla: Firefox.

The CVSS score is not provided, but the nature of the flaw suggests a high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. Likely exploitation requires delivery of crafted JavaScript to the user, for example via a malicious or compromised website, and succeeds when the JIT miscompiles the code. Given these constraints, the likelihood of exploitation is moderate, but the potential impact is severe.