This vulnerability allows a malicious web page to escape the sandboxed environment within the DOM's networking component. The flaw could let an attacker execute arbitrary code on the host system or disrupt browser operations, effectively turning a normally confined browser process into a fully privileged executor of code.

The issue affects Mozilla Firefox. All releases prior to Firefox 159, Firefox ESR 115.44, or Firefox ESR 153.6 are impacted. Users running legacy installations that have not been updated remain vulnerable.

The CVSS score is not listed in the available data, the EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, indicating no known public exploitation. Nonetheless, the flaw permits arbitrary code execution from any webpage, so an attacker could exploit it from a malicious site or content accessed by an unsuspecting user. The attack vector is inferred to be via user interaction with a compromised web page within Firefox.