JIT miscompilation in the JavaScript Engine's just-in-time compiler causes the browser to produce machine code that does not reflect the intended behavior. A malicious web page can trigger this miscompilation, leading to unintended operations and potentially allowing the attacker to execute arbitrary code in the user's browser process. The consequence is a remote code execution scenario that threatens the confidentiality and integrity of the data handled by the browser.

Mozilla Firefox and Thunderbird browsers are impacted. The vulnerability was addressed in Firefox version 158 and Thunderbird version 158, as well as the ESR releases 115.43 and 153.5; any earlier releases of these branches are considered vulnerable.

The CVSS score of 8.1 indicates a high severity level. The EPSS score is reported as less than 1%, suggesting a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector likely requires a malicious web page to deliver JavaScript that triggers the miscompiled JIT code; thus the exploitation scenario is remote, browser-based. Without a published exploit, the likelihood of real-world use remains uncertain, but the potential damage is high if an attacker can run arbitrary code on an end-user machine.