The CVSS 9.8 versus EPSS 0.00466 gap here is more analytically instructive than the severity score itself. A 9.8 reflects theoretical severity—an integer overflow in a graphics component can corrupt rendering buffers, corrupt font caches, or serve as a stepping stone toward sandbox escape. But the 0.00466 probability of active exploitation within 30 days tells a different story: either the exploitation pathway is narrow, requires nontrivial user interaction, or the vulnerable code path sits in rarely-exercised rendering logic rather than a hot path like WebGL or canvas operations.
The simultaneous patch across Firefox 154, two active ESR branches, and Thunderbird is a meaningful signal. When Mozilla routes a fix through three products on the same release cadence, that indicates mature backporting tooling and a methodical internal discovery—not emergency response to active exploitation. If this were a zero-day, you'd see hotfixes, not scheduled version bumps. This suggests Mozilla's own audit or a coordinated researcher disclosure caught the issue before the exploit market could mature around it.
For defenders, the priority question is whether this overflow lives in a WebGL or canvas hot path (elevated risk) or in something more esoteric like SVG path parsing or border rendering (helps explain the EPSS gap). Check your Firefox version telemetry to determine if the affected code path is exercised in your environment. The broader pattern worth watching: integer overflows in shared graphics libraries like Skia have recurred for fifteen years across Firefox, Chrome, Android, and other consumers—each treated as a product-specific CVE rather than addressed at the library layer. This fragmentation means the same genetic vulnerability likely lives in unpatched forks across the ecosystem, undetected. The EPSS gap may reflect not just exploitation difficulty, but attackers also struggling to map which version forks actually contain the live vulnerability.