The vulnerability allows a malicious script to escape the isolated sandbox that isolates workers in the Document Object Model. This sandbox escape gives an attacker the same privileges as the privileged browser or email client process, enabling unrestricted access to system resources and execution of arbitrary code.

Vendors affected Builds that do not include the fix are any Firefox releases older than 152, ESR 140.12, or ESR 115.37, and any Thunderbird releases older than 152 or 140.12. Users running those legacy versions are vulnerable until they apply the security update.

The CVSS score of 9.6 indicates a critical severity, while the EPSS score of < 1% suggests a very low probability of exploitation in the near term and the vulnerability is not listed in the CISA KEV catalog. Exploit scenarios involve delivery of malicious content—such as a compromised website or phishing email—to a user’s browser or Thunderbird instance, leading to a privilege‑escalating sandbox escape and potentially full system compromise.