A flaw in Firefox’s DOM security component allows attackers to bypass built‑in mitigations. Based on the description, it is inferred that bypassing this component could enable the injection of malicious scripts or other content that would compromise the confidentiality, integrity, or availability of the browsing or email session. The vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Thunderbird 153.4 and 157.

Mozilla Firefox and Thunderbird on any platform running releases before ESR 153.4 or before Firefox/Thunderbird 157, including the Extended Support Release used by enterprises. Any environment that still operates these older versions is potentially exposed.

The CVSS score of 9.6 marks this flaw as critical. The EPSS score of less than 1% indicates the probability of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog, which suggests that no widespread exploitation has been observed. Nevertheless, the attack surface remains a web page, email, or other DOM‑containing content that can trigger the vulnerability if a malicious page includes crafted elements designed to evade DOM security. The flaw could allow an attacker to inject malicious scripts or content that runs with the user’s privileges, compromising confidentiality, integrity, or availability.