The bug occurs when uninitialized memory in the DOM is accessed by the Web Serial component, allowing a malicious webpage to exploit the flaw and escape the browser sandbox. This can lead to execution of code outside the sandboxed environment, compromising the confidentiality, integrity, and availability of the host operating system. The weakness is an uninitialized variable usage.

Mozilla Firefox and Thunderbird users running versions before 158, and Firefox ESR and Thunderbird ESR versions before 153.5, are affected. All other releases are considered safe after the patch is applied.

The public EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV. The CVSS score is 9.6, indicating a critical severity. The attack vector is inferred to be from a malicious web page that can load Web Serial. Exploitation requires the target browser to allow Web Serial, a privilege granted to a web origin. Absent an updated patch or disabling Web Serial, the risk remains significant for users exposed to untrusted web content.