A flaw in the Netmonitor component allows an attacker to increase privileges within the user’s environment. The vulnerability is categorized as CWE‑269, indicating a weakness in the mechanism that manages user permissions. When exploited, the attacker can attain higher privilege levels than originally granted, potentially enabling further malicious actions such as executing arbitrary code or accessing protected data.

Mozilla products – Firefox and Thunderbird, including both standard and ESR releases, are affected. The vulnerability exists in any version prior to Firefox 148 and Firefox ESR 140.8, as well as Thunderbird 148 and Thunderbird ESR 140.8. Users running earlier releases should verify the specific version and apply the corresponding update.

The CVSS base score of 8.8 classifies the flaw as high severity, while the EPSS score of less than 1 % indicates a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the component’s role in network monitoring, the likely attack vector is local or semi‑remote exploitation within the application; this inference is drawn from the description, as the official CVE entry does not detail the exact vector.