Mitigation bypass in the DOM: Core & HTML component is a vulnerability that allows an attacker to circumvent built‑in browser mitigations that apply to the Core and HTML layers of the DOM. The CVE description does not document further consequences such as code execution or data access; it only states that the bypass exists.

Mozilla Firefox and Thunderbird versions older than 158 remain affected; the fix is available in version 158 and later. Users on earlier releases are vulnerable until they upgrade.

The CVSS score is 9.8 and the EPSS score is less than 1%, indicating a high severity yet low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is a malicious web page or email attachment that exploits the DOM: Core & HTML component bypass. No indication is provided that the vulnerability directly enables code execution or data exposure.