A number of vulnerabilities were fixed in Firefox that was fixed in the latest version. MSFA2021-08 describes it only as "memory issues that may be exploitable", and doesn't give any information:
Mozilla developers Alexis Beingessner, Tyson Smith, Nika Layzell, and Mats Palmgren reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
This is the boilerplate information they give for nearly every MSFA which bundles nearly all memory safety issues into one description. As usual, the bug reference is linked but it cannot be viewed.
When looking up the CVE, the only reference I can see is to this website which says the following:
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
This implies that it's one bug. Where did they get this information from, and are all the "safety bugs" in MFSA-2021-08 really specific to the HTML parser? So really, what is CVE-2021-23978?