Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks

An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme.

Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page.

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token.