A flaw in the DOM Content Processes component allows a malicious user to gain elevated privileges on the system, potentially giving an attacker control over the host environment. The weakness represents an improper privilege delegation problem, classified as CWE‑269. Successful exploitation would let the attacker bypass security boundaries and perform actions that normally require higher authority, compromising confidentiality, integrity, and availability of the affected machine.

The vulnerability affects Mozilla products, namely Firefox and Thunderbird. Versions prior to Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13 are impacted; administration must verify whether their installations fall in this range.

The CVSS score of 8.8 indicates a very high severity, while the EPSS score of less than 1% suggests a currently low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through malicious web content or a compromised add‑on that runs within a content process, which can then exploit the privilege escalation to reach system‑level execution. Because the flaw resides in the browser’s process isolation model, a successful attack would affect the entire host system rather than being limited to a single user or session.