A flaw in Mozilla’s JavaScript engine causes the engine to read uninitialized memory due to incorrect boundary checks when processing certain input. The consequence is that an attacker could trigger unpredictable behavior, such as reading sensitive data or executing arbitrary code, by delivering malicious JavaScript to the browser or email client.

All versions of Firefox older than 149 and all Firefox Extended Support Release versions older than 140.9 are affected, as are Thunderbird releases prior to 149 and Thunderbird ESR versions earlier than 140.9. These desktop applications execute external JavaScript, making any such version vulnerable.

The CVSS score of 9.1 indicates a high severity with a remote attack vector, yet the EPSS score of less than 1 % suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation has been reported. Because the weakness lies in the core JavaScript engine, any system that renders untrusted scripts—such as a web browser or email client—could be targeted.