The vulnerability originates from improper boundary checks in the Telemetry component of Mozilla products. By exploiting this flaw, an attacker can escape from the security sandbox that normally isolates browser or email client processes, thereby potentially accessing the underlying file system or executing arbitrary code. This weakness falls under CWE-119 (Buffer Overflow or Corruption). The impact is a loss of confidentiality, integrity, and availability for users running affected versions.

Mozilla Firefox (all releases, including ESR) and Mozilla Thunderbird (all releases, including ESR) are affected. The fix was applied in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Earlier versions lack the necessary boundary checks and remain vulnerable.

The CVSS score is 10, indicating a critical level of risk. EPSS indicates a very low but non-zero exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely deliver malicious content through a web page, extension, or phishing email that triggers the Telemetry component, after which they could use the sandbox escape to read or write arbitrary files. No additional attack prerequisites are noted beyond the presence of the vulnerable software.