A flaw in the DOM content processes component of Mozilla Firefox and Thunderbird permits a sandbox escape, allowing an attacker who can serve malicious content to break out of the content sandbox and execute code with higher privileges. This could lead to arbitrary code execution, data exposure, and compromise of the host system. The weakness can be categorized as an improper privilege escalation. The vulnerability was fixed in Firefox 158 and Thunderbird 158.

Prior versions of Mozilla Firefox and Thunderbird (up to but not including version 158) are affected. The vulnerability is present on all platforms that run these releases, as the content processes component is part of the core rendering engine.

No EPSS score or KEV listing is available, but the fact that the issue is fixed in version 158 suggests a high severity. The attack vector is inferred to be a local or remote attacker who can supply crafted web content to the victim’s browser or email client. With sufficient user interaction or in the presence of other vulnerabilities, the exploitation could result in full application compromise. Given the potential for remote code execution, the risk is considered significant until a patch is applied.