A Just‑In‑Time compiler miscompilation flaw in the JavaScript engine allows an attacker to influence how compiled code is executed, potentially enabling arbitrary code execution within the browser context. The vulnerability is rated with a CVSS score of 9.8, indicating a critical level of risk. No public exploit has yet been observed, but the severity suggests that successful exploitation could compromise confidentiality, integrity, and availability of the user’s system.

The issue is present in Mozilla Firefox releases prior to version 149 and in Firefox Extended Support Release (ESR) versions older than 115.34 and 140.9. Mozilla Thunderbird is affected in releases older than 149 and ESR releases older than 140.9. Users running any of these versions are vulnerable until they upgrade to a fixed release.

Given the high CVSS score, the flaw poses a significant risk. The EPSS score is under 1%, indicating a low probability of real‑world exploitation at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is via malicious web content that triggers JavaScript execution in the browser context, allowing the JIT to generate unsafe code (inferred). Detailed exploitation steps are not disclosed, so the exact conditions required remain unknown.