The Storage: IndexedDB component contains a flaw that allows a sandbox escape, enabling an attacker to execute arbitrary code outside the browser or mail client environment. The vulnerability is caused by an improper containment of IndexedDB operations, which can be triggered from untrusted web content or email attachments. Based on the nature of a sandbox escape, it is inferred that code would run with the same privileges as the user process that opened the compromised content.

Mozilla Firefox versions earlier than 148—including the ESR 140.8 release—and Mozilla Thunderbird versions earlier than 148—including the ESR 140.8 release—are vulnerable. Users running patched builds should verify that they have upgraded to at least the specified fixed releases.

The CVSS score of 10 indicates critical severity. The EPSS score of less than 1 percent suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, due to the high severity, it warrants immediate attention. Based on typical exploitation patterns of sandbox escapes, it is inferred that an attacker could use a malicious web page or crafted email attachment that leverages IndexedDB to trigger the vulnerability, thereby gaining full process privileges.