The vulnerability is a privilege escalation flaw within the DOM navigation component of Mozilla’s browser and email clients. The flaw arises from incorrect privilege checks (CWE‑266: Incorrect Privilege Management and CWE‑269: Improper Privilege Escalation). An attacker can exploit the defect to gain higher privileges than the application intends, which could be used to read or modify protected data or install persistent malware.

Mozilla Firefox and Mozilla Thunderbird are affected. Versions prior to Firefox 153 or Firefox ESR 140.13, and prior to Thunderbird 153 or Thunderbird ESR 140.13 lack the fix and therefore are vulnerable.

The CVSS score of 8.8 reflects a high severity. The EPSS score of less than 1 % indicates that exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector requires a victim to view a maliciously crafted webpage or email that triggers the navigation logic, after which the elevation of privileges can occur. No additional prerequisites are listed in the description.