A bypass of security controls in the DOM: Security component has been identified, rated with a CVSS score of 9.8. The vulnerability allows a malicious entity to circumvent established authorization checks, potentially enabling the execution of unauthorized code or content. This high‑severity weakness is classified under CWE‑288, indicating a failure to enforce or verify proper privileges. No explicit details are provided in the description, so the exact mechanics remain unspecified, but the impact is clear: the bypass can compromise both confidentiality and integrity of the affected applications.

Mozilla products are affected. The issue is fixed in Firefox 148 and the ESR 140.8 branch, as well as in Thunderbird 148 and Thunderbird 140.8. Versions older than these should be considered vulnerable until patched.

The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Despite this, the remote impact and the severity rating call for urgent action. Attackers would need to entice a user into loading malicious content or exploit a web page that interacts with the vulnerable component; the precise attack path is not detailed, so the likely vector is inferred to involve client‑side DOM manipulation or crafted web content that triggers the bypass. Even with low observed exploitation, the combination of high CVSS and critical functional impact warrants immediate remediation.