A race condition exists within the JavaScript Engine component, allowing multiple execution threads to corrupt internal state. Manipulation of this flaw can lead to unpredictable behavior, such as crashes or incorrect script execution. The primary impact is a denial of service to users, potentially leading to loss of functionality or unreliability within the affected application. The weakness is identified by CWE‑362 and CWE‑366, highlighting the concurrent access issue that underlies the problem.

Mozilla Firefox browsers and Thunderbird mail clients are affected, with all releases older than version 154 and the ESR 153.1 channel vulnerable. The flaw was addressed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird ESR 153.1. Versions newer than those releases, as well as other Mozilla products not using the JavaScript Engine component in the affected way, are not impacted.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of <1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, delivered through malicious web content that contains specially crafted JavaScript, because the flaw resides within the JavaScript engine that processes external scripts. Successful exploitation would require the user to load the malicious content, at which point the race condition could trigger a service disruption.