Sandbox escape in the DOM: Navigation component was discovered in Firefox, allowing an attacker to bypass the browser’s sandbox restrictions. The flaw was addressed in Firefox 159 and Firefox ESR 153.6.

Mozilla Firefox, specifically versions prior to 159 and the ESR line before 153.6.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating that formal exploitation data and public exploitation status are unknown. The most likely attack vector is a remote attacker delivering malicious DOM content to a user’s browser. With no public CVSS score, the precise severity cannot be quantified, but the nature of a sandbox escape suggests a high‑impact risk to confidentiality, integrity, and availability if exploited.