This vulnerability allows a malicious web page or crafted content to raise the privilege level of processes within the Document Object Model of Mozilla Firefox and Thunderbird, specifically affecting the navigation component. It is a classic privilege escalation weakness (CWE-269) that could enable an attacker to execute code or manipulate the browser state beyond normal restrictions. The defect was fixed in Firefox 159 and Thunderbird 159, so older versions remain vulnerable.

The defect exists in Mozilla Firefox and Thunderbird versions prior to 159. All installations of these browsers before the release that contains the patch are potentially impacted.

The CVSS score of 8.8 signals a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw relates to a privilege elevation within the browser, it poses a significant risk when an attacker can supply crafted content within a browser session. Even though no public exploit is documented, the high CVSS and the inferred local in‑browser attack vector suggest that the danger level remains substantial if the attacker gains any foothold in the browsing context.