The vulnerability resides in the File Handling component and allows an attacker to bypass the security mitigations that normally guard against malicious file inputs. This flaw removes protective checks that prevent the processing of harmful content, potentially weakening the browser’s defenses and creating a path for further exploitation. The weakness is classified as CWE-693, which relates to mechanisms that can be manipulated to bypass security controls.

Mozilla Firefox Extended Support Release versions before 153.5 and Mozilla Thunderbird versions before 153.5 are affected. Users who have not upgraded to ESR 153.5 or later remain exposed.

The CVSS score of 8.3 indicates high severity, while the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation probability but maintaining a serious risk if discovered. Based on the description, the likely attack vector is local or user‑initiated file access, as the flaw lies in how the browser processes file inputs. No confirmation in the provided data indicates that the bypass automatically leads to code execution.