This vulnerability arises from incorrect boundary conditions in an XPCOM component, allowing an attacker to escape the browser sandbox and execute arbitrary code with the privileges of the browser process. The flaw represents a buffer overflow (CWE-119), potentially compromising confidentiality, integrity, and availability.

The bug affects Mozilla Firefox and Thunderbird. Versions prior to Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, and Thunderbird 140.17, 153.4, 157 are vulnerable; any installation using those or earlier releases is at risk.

With a CVSS score of 9.6, this flaw hits the high severity range. EPSS Score: < 1%. The vulnerability is not listed in CISA KEV, which does not diminish its high impact. Attackers would need to deliver malicious content that triggers the XPCOM component, likely through a malicious website or injected code, to reach the sandbox escape. The likely attack vector is delivering such malicious content via compromised or malicious web pages.