The Enterprise Policies component in Mozilla Firefox and Thunderbird fails to correctly enforce corporate policy, allowing a malformed or otherwise crafted policy entry to be accepted. This flaw can enable the program to perform operations that should have been restricted by policy, thereby undermining the intended security controls.

Mozilla Firefox versions earlier than 158 or the 153.5 ESR release, and Mozilla Thunderbird versions earlier than 158 or the 153.5 ESR release, remain vulnerable because the fix was applied in those releases and later.

The CVSS score of 8.1 signals a high severity impact, while the EPSS score of less than 1% indicates a very low probability that the vulnerability is being actively exploited in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Because the flaw concerns policy enforcement, the likely attack surfaces are a local user who can supply a malicious policy file or a remote attacker who can cause the client to parse such a file, enabling policy bypass. The exact attack vector is not detailed in the advisory, so the assessment is based on typical usage scenarios of Enterprise Policies.