The reported vulnerability permits an attacker to bypass security mitigations implemented in Mozilla’s HTML parser. By providing specially crafted HTML, an attacker can override safeguards that normally prevent malicious content from being processed or displayed, potentially enabling privilege escalation or code execution within the user’s session. The weakness involves improper authorization (CWE‑288).

Affected products are Mozilla Firefox and Mozilla Thunderbird, including both mainline and extended‑support releases. All versions older than Firefox 148, Firefox ESR 115.33 and 140.8, Thunderbird 148, and Thunderbird ESR 140.8 are vulnerable and should be upgraded.

The CVSS score of 9.8 classifies this as a critical vulnerability, yet the EPSS score of less than 1% indicates a low projected exploitation probability. The issue is not listed in the CISA KEV catalog. Attackers would need to craft malicious HTML that a user loads in the browser or email client—a realistic scenario in ordinary browsing and email consumption. Consequently, exploitation is unlikely in the short term, but the high severity warrants prompt action.