A vulnerability in the WebExtensions component of Firefox and Thunderbird allows an attacker to gain higher privileges than intended. The flaw occurs when the component does not properly enforce the permissions granted to extensions, enabling an attacker to execute privileged actions or access protected data, which can lead to unauthorized access to user data and potentially compromise the entire browser session.

Mozilla Firefox and Thunderbird users running a version older than the fixed releases (Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5) are affected. The vulnerability was fixed in those releases, so only earlier versions remain at risk.

EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a lower public visibility so far. The CVSS score of 8.8 indicates high severity and suggests potential for significant impact. The likely attack vector is the installation or execution of a malicious or compromised WebExtension that can exploit the improper access control to elevate privileges. Vulnerable users who install such extensions locally or from third‑party sites are at greatest risk.