This vulnerability allows local or web-based attackers to exploit the DOM UI Events and Focus Handling component in Mozilla Firefox to gain higher privileged execution within the application. An attacker could trigger malicious script or content to elevate privileges, potentially leading to arbitrary code execution in the context of the browser. The flaw is a classic privilege‑escalation flaw, described as an insufficiency in access control over focus and event handling mechanisms. The impact is confined to the Firefox process and potentially other privileged extensions or processes invoked by the browser, but it can be leveraged to compromise the user’s system by executing arbitrary code within the browser context.

Mozilla Firefox is affected. All releases prior to Firefox 159 and the ESR 153.6 branch contain the flaw. Versions 159 and later, as well as ESR 153.6 and newer, contain the fix and are not vulnerable.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation to date. The CVSS score is not provided, so the baseline severity is inferred from the nature of privilege escalation. An attacker would need to deliver malicious content via a web page or local file that triggers UI event handling, making exploitation less likely for remote attacks but still feasible for targeted users or local attackers. Due to the lack of publicly known exploitation, the risk remains moderate until a patch is applied, but the high potential impact warrants prompt remediation.