The vulnerability in the Bookmarks & History component allows a mitigation bypass that lets an attacker insert malicious entries to override the browser’s intended controls. The weakness is an input validation failure combined with improper authorization, classified as CWE‑693, and can be used to alter, delete, or otherwise manipulate stored bookmark and history records.

Mozilla Firefox versions prior to 157 and Firefox ESR versions older than 153.4, as well as Thunderbird versions older than 153.4 and 157, are affected. Fixed releases are Firefox ESR 153.4, Firefox 157 and all later releases, Thunderbird 153.4, Thunderbird 157 and all later releases.

The CVSS score of 9.6 indicates a high severity impact. The EPSS score of < 1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to supply crafted bookmark or history entries, possibly introduced locally or via a user’s interaction with a malicious link. Given the low exploitation probability and high severity, the overall risk is severe but relatively unlikely to be actively exploited.