Mitigation bypass in the DOM security component allows attackers to inject malicious code that can run in the context of a web page. The flaw undermines the browser's defenses, enabling the execution of arbitrary JavaScript and leading to potential theft of credentials, session hijacking, or defacement of web content. By bypassing the intended DOM security controls, the vulnerability can affect any page rendered by Firefox.

The vulnerability impacts Mozilla Firefox versions prior to 159 and the Firefox ESR series prior to 153.6. All installations of those older builds lack the fix and are susceptible to DOM-based exploitation when a malicious site contains the bypass payload.

The EPSS score is not available and a CVSS score is not disclosed, so the exact exploitation probability and severity cannot be quantified at this time. Based on the description, it is inferred that the attack vector involves a malicious web page that a user might visit, which then leverages the DOM component's bypass. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits have been documented yet, but the lack of official listing does not mitigate the risk; user systems should be updated promptly. Because the flaw allows code execution in the user's browser context, the risk to confidentiality, integrity, and availability of user data and the browser session is high.