The flaw stems from incorrect boundary checks in the telemetry component, allowing an attacker to escape the browser sandbox and execute code with elevated privileges. This type of memory corruption can compromise the confidentiality, integrity, and availability of the affected system, and is rated with a CVSS score of 9.6, indicating critical severity.

Mozilla products are impacted, namely Firefox and Thunderbird. Versions prior to Firefox 149, Firefox ESR 115.34 and 140.9, and Thunderbird 149 or 140.9 contain the vulnerability, while the listed releases contain the fix.

The EPSS score of less than 1% suggests that active exploitation has not been observed, and the vulnerability is not in the CISA KEV catalog. Nevertheless, the high severity and sandbox escape mechanism mean that an attacker who can trigger the flaw—through malicious telemetry data or compromised extensions—could achieve full system compromise. The risk remains high until the necessary updates are applied.