The vulnerability is a race condition in the XPCOM component of Mozilla Firefox and Thunderbird. The description explicitly mentions that the race condition existed until the security fixes shipped in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. No specific impact details were disclosed, so the exact consequence of this race condition remains unknown and may affect confidentiality, integrity, or availability, depending on how an attacker manages to exploit the bug.

Mozilla Firefox and Thunderbird releases earlier than the specified patches—any build older than Firefox 158, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5—are affected. Users who still run these older versions should be aware that the XPCOM component still contains the race condition until the fixes arrive.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating no known public exploitation data. A CVSS score has not been published, so the severity assessment cannot be quantified. Without evidence of exploitation or detailed impact, the current risk remains uncertain. However, the presence of a race condition in a core browser component suggests that prompt application of the patch is prudent until an impact assessment becomes available.