For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token.

An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme.

Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page.

Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks