A flaw in the Service Workers component of Mozilla Firefox and Thunderbird enables privileges normally reserved for trusted service workers. This can allow an attacker to read or modify sensitive user data, alter network requests, or otherwise compromise the browser’s isolation guarantees. The weakness is identified as Improper Authorization (CWE‑269).

Mozilla Firefox versions older than ESR 140.17, ESR 153.4, or the non‑ESR release 157 are vulnerable. Mozilla Thunderbird versions older than 140.17, 153.4, or 157 are also affected. Each of these products includes a patch in the releases listed above; installations running earlier versions remain vulnerable.

The CVSS score of 8.8 indicates a high‑severity vulnerability; the EPSS score of < 1% suggests a low likelihood of exploitation at present. The vulnerability is not recorded in the CISA KEV catalog. Based on the description, the likely attack path involves a web page registering a Service Worker that triggers the flaw, thereby elevating privileges for code running in that context.