Mitigation bypass in the DOM security component of Mozilla Firefox and Thunderbird allows an attacker to override the browser’s built‑in DOM protections, enabling execution of scripts or access to data that should otherwise be restricted. This constitutes an improper access control weakness that could compromise confidential information or allow the attacker to execute arbitrary code on the victim’s system. The vulnerability can lead to confidentiality, integrity, or availability compromise if successfully exploited. Based on the description, it is inferred that the likely attack vector involves client‑side code execution through malicious web content or local files, as the DOM bypass would be triggered by code that runs in the browser.

Affecting all installations of Mozilla Firefox and Thunderbird that contain the vulnerable DOM security component. The issue was fixed in Firefox 158 and Thunderbird 158, so any build with a version number lower than 158 is potentially susceptible. No additional vendor or product information is published beyond the Mozilla products listed in the CNA data.

The EPSS score of < 1 % indicates a low likelihood that this vulnerability will be exploited in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. The CVSS score is 7.3, indicating a high severity that can lead to significant impact on confidentiality, integrity, and availability. Based on the description, it is inferred that the attack requires client‑side code execution via malicious web content or locally served files, and a user who visits or opens the crafted content. While no public exploit has been reported, the ability to bypass DOM mitigations could allow an attacker to run arbitrary scripts or read protected data, which could be leveraged for credential theft or further lateral movement.