The vulnerability in Mozilla's Address Bar component permits privilege escalation. By manipulating the component, an attacker can increase privileges within the browser process, potentially executing malicious code with higher authority than intended. Both Firefox and Thunderbird are affected, as the issue is fixed in Firefox ESR 153.4, Firefox 157, ESR 140.17, and Thunderbird 153.4, 157, and 140.17.

Mozilla Firefox and Mozilla Thunderbird. All releases prior to Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17, and all Thunderbird releases before 140.17, 153.4, and 157 are affected. The fixes were released in those specific patched versions, so any older or unpatched installations remain vulnerable.

The vulnerability has a CVSS score of 8.8, reflecting high severity. Its EPSS score is less than 1%, indicating a low probability of exploitation, and it is not listed in CISA's KEV catalog. The likely attack vector is interaction with the Address Bar, such as entering a crafted URL or leveraging user-triggered input, which could lead to elevation of privileges for the browser process. Because exploitation grants an attacker significant control over the affected system, the overall risk remains high regardless of the low EPSS.