The vulnerability is a sandbox escape caused by incorrect boundary conditions in the Networking component of Mozilla Firefox and Thunderbird. This flaw permits an attacker to corrupt memory and execute arbitrary code with the privileges of the browser process, potentially leading to a compromise of the host system. It is a classic buffer overflow‑like issue categorized as CWE‑119.

Mozilla Firefox versions older than 158 on the mainline and 153.5 or older on the ESR branch, as well as Mozilla Thunderbird versions older than 158 on the mainline and 153.5 or older on the ESR branch, are affected. Because these browsers are available on all major operating systems, all installations of the affected versions on Windows, macOS, Linux, and other supported platforms are at risk.

The CVSS score of 9.6 signifies critical severity. The EPSS score of < 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the nature of a sandbox escape, the likely attack vector originates from network traffic or malicious content processed by the browser; this inference is drawn from the mention of the Networking component. While no public exploit is documented, the impact of escaping the sandbox could allow an attacker to execute arbitrary code outside the browser context.