A miscompilation in the JavaScript engine’s Just‑In‑Time (JIT) compiler can alter the machine code produced from JavaScript, enabling an attacker to execute arbitrary code within the context of the browser. The flaw occurs when the JIT optimizer incorrectly translates certain JavaScript constructs, leading to memory corruption that can be abused for remote code execution. This weakness is a form of improper initialization (CWE‑665). This also affects Thunderbird, which uses the same JavaScript engine.

Mozilla Firefox and Thunderbird, including all standard releases that were addressed by the patch series. The vulnerability was fixed in Firefox 158, Firefox Extended Support Release version 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5; any earlier Firefox, ESR, or Thunderbird revision is affected.

The lack of a publicly available CVSS or EPSS score limits precise severity quantification, yet the nature of the bug—remote code execution triggered by malicious web content—implies a high‑risk exposure. The attack vector is remote, requiring no privileged user interaction, and although the vulnerability is not currently listed in the CISA KEV catalog, the potential for exploitation remains significant.