This vulnerability is a denial‑of‑service flaw in the Sync component of Firefox and Thunderbird that can cause the application to hang or consume excessive resources, resulting in availability loss for users. The weakness is classified as CWE‑400, reflecting uncontrolled resource consumption. Based on the description, it is inferred that an attacker could trigger the issue remotely by sending a crafted sync request or manipulating account credentials, leading to a compromised browsing session until the browser is restarted or rebooted.

Firefox and Thunderbird installations earlier than version 158 are affected. The Sync feature synchronizes user data across devices; all versions prior to 158 lack the vendor‑supplied fix, while 158 and later contain the patch.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting lower likelihood of known exploitation. However, because the attack vector is likely remote and requires only access to the Sync component, the risk remains significant for systems still running vulnerable Firefox editions.