The vulnerability arises from a Just‑In‑Time (JIT) compiler miscompilation in the JavaScript engine. This defect can allow an attacker to execute arbitrary code within the context of a vulnerable application. The weakness is classified as an improper use of a data type, as reflected by the CWE identifiers, and has the potential to compromise confidentiality, integrity, and availability.

Affected products are Mozilla Firefox and Mozilla Thunderbird, including the standard releases and ESR tracks. Versions before Firefox 149 and ESR 140.9, and before Thunderbird 149 and ESR 140.9, contain the unpatched JIT miscompilation. All other newer releases include the fix.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of JIT miscompilation, the likely attack vector is remote via malicious JavaScript executed in a browser context, although explicit exploit details are not provided in the dataset.