A flaw in Mozilla’s Security: Process Sandboxing component enables an attacker to escape the confined environment and obtain higher privileges than intended by the browser’s design. This results in the loss of isolation between browser processes, permitting attackers to execute arbitrary code or manipulate system resources as a privileged user. The vulnerability is an elevation of privilege issue that could compromise the integrity and confidentiality of user data.

The vulnerability affects all Firefox builds released before Firefox ESR 153.4 and before Firefox 157, as well as all Thunderbird builds released before Thunderbird 157 and before Thunderbird ESR 153.4. Users running earlier ESR releases of either browser remain exposed and must update to at least the specified patch versions.

The CVSS score of 9.6 indicates a critical severity. The EPSS score of <1% suggests a relatively low likelihood of exploitation, but the impact of breaking browser sandboxing remains significant. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is malicious web content that exploits the process sandbox, allowing a remote or local attacker who can influence page execution to trigger the escape. Successful exploitation would grant code execution privileges in the user's process space.