The flaw permits privilege escalation in Mozilla Firefox and Thunderbird by exploiting the Panning and Zooming component. An attacker can elevate privileges beyond those granted to the user, enabling execution of code with higher rights. The vulnerability was addressed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Mozilla Firefox and Thunderbird versions earlier than 158, as well as Extended Support Release versions earlier than 153.5, are affected. The issue was addressed in Firefox 158, ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

The CVSS score is 8.8, and the EPSS score is < 1%, indicating a very low but non-zero exploitation probability. The vulnerability permits privilege escalation, posing a high risk to confidentiality, integrity, and availability if exploited. Public exploits have not been reported, but the vulnerability remains exploitable. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is localized to Firefox’s Panning and Zooming component, the likely attack surfaces involve web content or user interactions, which is inferred based on the component’s exposure to user interactions.