The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via several vectors related to the browser engine, including `nsEventStateManager::GetContentState`, `nsNativeTheme::CheckBooleanAttr`, `UnhookTextRunFromFrames`, `ClearAllTextRunReferences`, `nsTextFrame::ClearTextRun`, `IsPercentageAware`, `PL DHashTableFinish`, `nsListBoxBodyFrame::GetNextItemBox`, `AtomTableClearEntry`, `nsHTMLEditor::HideResizers`, and `nsWindow::SetCursor`. These vectors are related to the atom table, DOM mutation events, and Unicode surrogates.