A vulnerability in the WebExtensions component of Firefox allows an attacker to gain higher privileges than intended. The flaw occurs when the component does not properly enforce the permissions granted to extensions, enabling an attacker to execute privileged actions or access protected data. This can lead to unauthorized access to user data and potentially compromise the entire browser session.

Mozilla Firefox users running a version older than 158, including the ESR 153.5 branch, are affected. The vulnerability has been fixed in Firefox 158 and Firefox ESR 153.5, so only these releases are at risk.

EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a lower public visibility so far. The lack of a public CVSS score and exploit data means the severity and prevalence of attacks are not well understood. The likely attack vector is the installation or execution of a malicious or compromised WebExtension that can exploit the improper access control to elevate privileges. Vulnerable users who install such extensions locally or from third‑party sites are at greatest risk.