The vulnerability is a privilege escalation flaw within the DOM navigation component of Mozilla Firefox and Thunderbird. The defect allows an attacker to gain higher privileges than the application intends, potentially enabling read or modification of protected data or installation of persistent malware. The weakness corresponds to CWE‑266 (Incorrect Privilege Management) and CWE‑269 (Improper Privilege Escalation).

Mozilla Firefox and Mozilla Thunderbird are affected. Versions prior to Firefox 153 or Firefox ESR 140.13, and prior to Thunderbird 153 or Thunderbird ESR 140.13 lack the fix and therefore are vulnerable.

The CVSS score of 8.8 reflects a high severity. The EPSS score of less than 1 % indicates that exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector requires a victim to view a maliciously crafted webpage or email that triggers the navigation logic, after which the elevation of privileges can occur. No additional prerequisites are listed in the description.