Denial Of Service (DoS)

firefox is vulnerable to denial of service. Memory corruption due to missing sign-extension for ValueTags on ARM64 allows an attacker to crash the application...

Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64

The Mozilla Foundation Security Advisory describes this flaw as: Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash...