The vulnerability involves a mitigation bypass within Mozilla Firefox’s Enterprise Policies component. The bypass potentially allows alteration or removal of configuration restrictions that are normally enforced by the browser. Based on the description, it is inferred that an attacker who can modify these restrictions could gain increased privileges or execute code that would otherwise be blocked. The weakness is categorized as a privilege escalation flaw, providing higher-level controls than intended.

The issue affects Mozilla Firefox versions released prior to Firefox 158 and the ESR 153.5 branch, as well as Mozilla Thunderbird versions released prior to Thunderbird 158 and Thunderbird 153.5. Versions after these releases contain a fix that prevents the bypass of enterprise policy settings. Users running older releases should verify that they are not among the affected versions.

The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability requires the ability to influence or replace enterprise policy configuration, which would typically indicate a local or privileged user at minimum. Without a public exploit or detailed attack path, the risk remains moderate to high for environments that rely on these policies for security enforcement. The CVSS score of 5.4 indicates a moderate overall risk.