The vulnerability permits an attacker to bypass security mitigations within the Web Compatibility: Tooling component, potentially allowing malicious code or content to escape the intended sandbox. This weakness relates to improper enforcement of permissions, as indicated by the associated CWE-288 classification. The failure to enforce these mitigations could compromise the integrity of the browser or email client by permitting unauthorized actions that exceed the intended scope of the component.

Mozilla Firefox and Mozilla Thunderbird are affected, specifically all releases prior to version 143. Users of any earlier Firefox or Thunderbird build are vulnerable until they upgrade to the patched version.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score of less than 1% shows a low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited in the wild. Nonetheless, the possibility of a mitigation bypass mandates timely patching to prevent potential privilege escalation.