A flaw in the Telemetry component’s boundary checks permits the contents of a sandboxed process to escape its confines. The weakness is a classic buffer or array overread (CWE‑120), combined with signed/unsigned conversion errors (CWE‑501) and memory management issues (CWE‑754), allowing malicious input to read or write beyond the intended memory region. If successfully exploited, the attacker could execute arbitrary code with the privileges of the sandbox, potentially compromising user data, confidentiality, integrity, or even taking full control of the host system.

This vulnerability affects Mozilla Firefox builds older than version 149, including Firefox ESR releases preceding build 115.34 and those before 140.9. It also applies to Mozilla Thunderbird versions older than 149 or prior to 140.9. Users on any of these configurations are at risk of encountering a sandbox escape that could lead to arbitrary code execution.

The reported CVSS base score of 9.6 places the flaw in the high‑severity category. EPSS indicates a low probability of exploitation (<1 %) and the flaw is not presently listed in CISA’s KEV catalogue. The likely attack vector would involve delivering crafted telemetry data, possibly via malicious web content or adjacent services, to trigger the incorrect boundary checks. While the technical feasibility is clear, the exploitation prerequisites are narrow, suggesting that disciplined patching remains the most effective defense.