Mozilla reports an “Other issue in the WebRTC component” that has received a CVSS of 9.8, indicating a high‑impact flaw. The associated weakness is Code Injection (CWE‑94), suggesting that an attacker may be able to inject and execute code within the browser context. The official description does not disclose the precise attack mechanism, so the exact outcomes remain unspecified, but the severity rating indicates that, if exploited, the vulnerability could compromise the integrity of the affected system.

Firefox Extended Support Releases and Thunderbird releases older than version 140.10.2 are impacted. Users continuing to run any ESR build prior to 140.10.2 or Thunderbird earlier than that version may encounter this issue in the WebRTC component.

The EPSS score is listed as less than 1%, implying a low probability of exploitation in the wild at the time of analysis. The vulnerability is not included in CISA’s KEV catalog, indicating no known publicly available exploits. The high CVSS score reflects the potential for serious impact, though the lack of publicly disclosed exploitation details means the real‑world risk is uncertain and appears low based on current evidence.