The vulnerability arises from incorrect boundary checks in the JavaScript Engine's Just‑In‑Time (JIT) component. The flaw can corrupt memory and potentially enable arbitrary code execution in the context of a user who opens a malicious web page. It represents a serious code‑execution risk for affected Firefox installations.

The flaw affects Mozilla Firefox versions up to 158 and the ESR 153.5 release. Any Firefox build prior to these versions is vulnerable when rendering JavaScript. The bug was addressed in Firefox 158 and Firefox ESR 153.5.

No CVSS score is currently published, and the EPSS score is not available, so the exact probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through malicious JavaScript executed in a browser context, and exploitation would require the victim to visit a compromised or malicious web page. The potential impact is remote code execution, which could allow an attacker to take full control of the victim's system.