The vulnerability is identified as an ‘Other issue’ in the JavaScript Engine component of Mozilla products. The advisory does not provide a detailed technical description, so the exact nature of the flaw—whether it results in a crash, memory corruption, or another form of failure—is not disclosed. Users may encounter unexpected crashes or erratic browser behavior, but no confirmed remote code execution or data exfiltration is indicated.

Mozilla Firefox and Mozilla Thunderbird are affected. The issue existed in all releases prior to version 150 and was fixed in that release; no more granular version information is provided, so all revisions below 150 should be considered vulnerable.

The CVSS score is 5.3, indicating a medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can supply crafted JavaScript to a vulnerable client might attempt to trigger the bug, but without a detailed trigger or affected context the likelihood of successful exploitation remains uncertain. Administrators should treat the vulnerability as potentially high until further clarifying information is released.