Mitigation bypass in the Enterprise Policies component of Mozilla Firefox and Thunderbird allows an attacker to defeat the enforcement of mitigations that are normally preset by those policies. The vulnerability can permit changes to security settings that would otherwise be controlled by the policy engine

Mozilla Firefox versions older than 158 and Mozilla Firefox ESR releases older than 153.5, as well as Mozilla Thunderbird releases older than 158 and Mozilla Thunderbird ESR builds older than 153.5, are vulnerable. The fix is delivered in Mozilla Firefox 158 and subsequent ESR releases 153.5+, and in Mozilla Thunderbird 158 and subsequent ESR releases 153.5+

The CVSS score of 8.1 signals high severity. The EPSS score, below 1 %, and absence from the CISA KEV catalog imply a low likelihood of exploitation. The description does not specify an attack vector; however, the nature of the bypass—affecting policy-controlled mitigations—suggests that an attacker would need local or privileged access to the affected system for exploitation. This inference is drawn from the description and typical deployment of enterprise policy devices, but the actual vector remains unspecified by the vendor.