JIT miscompilation within the JavaScript: WebAssembly component can cause the just‑in‑time compiler to generate incorrect machine code for WebAssembly modules. The erroneous compilation path may allow an attacker to execute arbitrary code within the browser context, potentially compromising confidentiality, integrity, or availability of the user system. The impact is inferred from the known nature of JIT miscompilations, which historically have yielded execution of attacker‑controlled code.

Mozilla Firefox users running versions earlier than 158, or Firefox ESR queues earlier than 153.5, are vulnerable. The fix was introduced in Firefox 158 and Firefox ESR 153.5. All installations of these browsers on affected versions that have not applied the update are at risk.

No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is not provided in the data, but the potential for arbitrary code execution indicates a high severity if exploited. The most likely attack vector is the delivery of malicious WebAssembly code through a compromised or malicious web page, which would be compiled incorrectly by the vulnerable JIT engine. The lack of publicly reported exploits and the absence from KEV suggest an exploitation probability that is currently uncertain, yet the potential impact remains severe if an exploit is discovered.