The vulnerability allows a sandbox escape due to incorrect boundary checks in the DOM, enabling an attacker to execute arbitrary code with higher privileges than the sandbox permits. The flaw resides in the Core & HTML component and is a typical buffer overflow scenario (CWE‑119). An attacker could leverage this to compromise user data or system integrity once the victim processes malicious web content or an email with crafted HTML.

Mozilla Firefox versions up to and including 147 and all ESR builds older than 115.33 and 140.8, and Mozilla Thunderbird versions up to 147 and ESR builds older than 140.8 are affected. The exploit has been fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

With a CVSS score of 10 the risk is maximal, yet the EPSS indicates a very low likelihood of exploitation (<1 %). The vulnerability is not currently listed in the CISA KEV catalog. Attackers would most likely use a malicious webpage or an infected email that contains crafted HTML to trigger the sandbox escape. Because the flaw involves a buffer overflow, a successful exploitation would lift sandbox restrictions and allow arbitrary code execution on the victim’s system.