The vulnerability is a use‑after‑free in the Disability Access APIs component that the description indicates can lead to a sandbox escape. Based on the wording, this would allow an attacker to break out of the browser’s security boundaries and potentially execute code outside the protected environment, jeopardizing confidentiality and integrity of user data.

This issue affects Mozilla Firefox and Thunderbird. Versions before Firefox ESR 153.4 and Firefox 157, as well as Thunderbird 153.4 and Thunderbird 157, are vulnerable. Fixed releases include Firefox ESR 153.4, Firefox 157, and the corresponding Thunderbird updates.

With a CVSS score of 9.6 and an EPSS score of less than 1%, the vulnerability is highly severe but the likelihood of exploitation remains low. It is not listed in the CISA KEV catalog. Because a sandbox escape would grant an attacker control over processes the browser has access to, the potential impact is arbitrary code execution on the host. Attackers would likely need to supply malicious content that triggers the use‑after‑free; however, no public exploits are reported, so the immediacy of the threat is moderated by the low EPSS.