A flaw in the Application Update component of Mozilla Firefox and Thunderbird allows an attacker to gain elevated privileges. By exploiting this weakness, an adversary can run code with higher authority than intended, potentially compromising the entire system. The vulnerability is explicitly labeled as a privilege escalation issue and is formally addressed in official security advisories.

Mozilla Firefox versions earlier than 158 and Firefox ESR versions earlier than 153.5, as well as Mozilla Thunderbird versions earlier than 158 and Thunderbird ESR 153.5, are vulnerable. The flaw is fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird ESR 153.5, so any installation not yet updated to these releases is at risk.

With a CVSS score of 8.8, this vulnerability is classified as high severity. The EPSS score is less than 1% and it is not listed in CISA KEV, indicating no publicly documented exploits. Nonetheless, the privilege escalation can be achieved via the Application Update mechanism, potentially requiring a malicious update file. The absence of known exploits does not reduce the inherent risk, particularly in environments that rely on manual or legacy update processes.