The flaw stems from incorrect boundary checks in Firefox’s Widget: Win32 component, which can lead to out-of-bounds memory access (CWE-119) as a result of the boundary mismatch, and as a consequence allow a sandbox escape (CWE-653). When triggered, an attacker can break out of the browser sandbox and potentially execute arbitrary code within the user’s session.

All Mozilla Firefox releases prior to version 158 and the ESR 153.5 branch contain the unpatched Widget: Win32 component. Versions 158 and later, as well as ESR 153.5 and later, contain the fix. Any system maintaining an older Firefox build is vulnerable. Similarly, Mozilla Thunderbird releases prior to version 158 and the ESR 153.5 branch are affected, with the same fix applied from version 158 onward.

The CVSS score of 9.6 indicates a critical severity for this sandbox escape flaw. The EPSS score of less than 1% suggests a low likelihood that exploit code is currently available or actively observed. The vulnerability is not listed in CISA’s KEV catalog, so there is no known large‑scale exploitation activity. While the description does not specify a preferred attack surface, the flawed Widget: Win32 component implies that malicious web content or a downloaded payload processed by the browser could trigger boundary violations, allowing an attacker to escape the sandbox and execute code with the user's privileges. The resulting impact is significant, as sandbox escape removes isolation boundaries and enables arbitrary code execution on the system.