The vulnerability arises from incorrect boundary checks in the Networking component, which can cause a sandbox escape and allow an attacker to execute code with elevated privileges. This flaw directly threatens the integrity and confidentiality of the affected system by granting the attacker the ability to run arbitrary code.

Mozilla products that are impacted include Firefox and Thunderbird versions older than 152. The fix was delivered in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37, as well as in Thunderbird 152 and Thunderbird ESR 140.12. The issue is confined to the Networking component of these browsers and does not affect later releases.

The EPSS score of less than 1 % denotes a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves processing untrusted network content, such as visiting a malicious website or opening an infected email attachment; once this boundary error is triggered, the sandbox can be bypassed and arbitrary code may run. The CVSS score of 9.6 indicates a critical severity.