The vulnerability involves the fork server leaking file descriptors to web content processes. This defect permits an attacker to gain unauthorized access to privileged resources, potentially elevating privileges or executing malicious code. The weakness is an access control flaw that allows a less privileged process to read or manipulate file descriptors beyond its intended scope. The impact is a breach of confidentiality, integrity, and availability of system resources, with the ability to compromise the entire system if the attacker is on the same host.

Mozilla Firefox and Mozilla Thunderbird are affected. The flaw has been fixed in Firefox version 137 and Thunderbird version 137. Earlier releases of these browsers remain vulnerable.

The CVSS score of 7.4 indicates a high severity vulnerability. EPSS indicates a very low probability of exploitation (< 1%) at the time of analysis, and the vulnerability is not currently listed in CISA KEV. The likely attack requires local access to the fork server, which can be reached by privileged web content processes. Without an exploit, remote attackers cannot leverage this flaw; however, a local attacker can use it to upgrade privileges and potentially hijack system resources.