This vulnerability permits an attacker to gain elevated privileges within the Firefox browser by exploiting a flaw in the WebExtensions component. Based on the description, it is inferred that the flaw allows privileged operations that would normally be restricted by the browser’s security model, potentially leading to code execution or accessing sensitive data in the user’s profile, consistent with a general privilege escalation flow.

The flaw affects Mozilla Firefox and Thunderbird across all operating systems for any release prior to 158, including Windows, macOS, and Linux. Users must verify whether they run a version earlier than 158 to determine if they are impacted.

The CVSS score is 8.8, the EPSS score is < 1%, and the vulnerability is not listed in KEV, making the precise risk assessment uncertain. The likely attack vector is inferred to be local exploitation through a compromised environment, or remote exploitation if an extension can be supplied to a victim. Remaining unpatched browsers may be susceptible if an attacker can supply malicious extensions.