The flaw stems from incorrect boundary checks in Mozilla’s Internationalization component, which allows an attacker to escape the browser or email client sandbox and execute arbitrary code on the host system. This can compromise the confidentiality and integrity of the affected machine, as code outside the sandbox runs with the privileges of the user.

Mozilla Firefox versions older than ESR 153.4, Firefox 157, or Firefox ESR 140.17, as well as Thunderbird releases earlier than ESR 153.4, Thunderbird 157, or Thunderbird 140.17, are vulnerable. Users and administrators must verify the running versions of both products and apply the latest security update to mitigate the risk.

With a CVSS score of 9.6 and a very low EPSS probability (<1%), the quantified likelihood of exploitation is low, yet the high severity and lack of a CISA KEV listing mean that any successful exploitation would be devastating. The likely attack vector involves supplying crafted internationalized content—such as a malicious web page or email—triggers the boundary error, breaks the sandbox, and allows code execution. The combination of a proven exploitation path and remote code execution capability warrants urgent remediation.