A race condition exists within the JavaScript garbage collector component. This flaw can allow the garbage collector to behave unpredictably, potentially corrupting memory or causing the browser or email client to crash. Such crashes are a typical denial‑of‑service outcome for end‑users.

The vulnerability affects Mozilla Firefox and Mozilla Thunderbird installations that use the legacy JavaScript engine. All versions up to and including 147 are vulnerable because the fix was introduced in Firefox 148 and Thunderbird 148.

The CVSS score of 4.2 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation has not been observed and is unlikely. The flaw is not listed in the CISA KEV catalog. Based on the type of weakness, an attacker would need to trigger the race, likely through a locally executed malicious script or as a privileged user. There is no public evidence of remote exploitation; the attack surface appears to be limited to local or same‑origin contexts.