A flaw in the JavaScript garbage‑collection component allows an attacker to influence the collection process during memory reclamation. This can undermine the built‑in security mitigations of the browser, potentially allowing unintended code paths or memory manipulation. The flaw is mapped to CWE‑693 (Information Exposure Through Trust‑Boundary Windows) and CWE‑807 (Failure to Verify Signature), indicating that the vulnerability involves improper handling of trust and information flow.

Mozilla Firefox users running any release prior to version 154, or the ESR branch before 153.1, are vulnerable. Mozilla Thunderbird users using releases older than 154, or ESR prior to 153.1, are likewise affected. The security fix is included in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

The vulnerability has a CVSS score of 9.1, reflecting high severity. The EPSS score is below 1%, implying a very low probability of public exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector requires delivery of malicious JavaScript to the victim’s browser, which could be achieved via phishing or compromised web pages. No public exploitation has been reported, but the high severity and the nature of the flaw merit cautious attention if malicious code can be executed.