This vulnerability arises from incorrect boundary conditions and integer overflow in the XPCOM component of Mozilla products, allowing a sandbox escape that can execute arbitrary code with full system privileges. The flaw can compromise confidentiality, integrity, and availability of the host. It is a buffer overflow (CWE‑120), integer overflow (CWE‑190), and unchecked buffer bounds (CWE‑754) issue.

Affected products include Mozilla Firefox and Thunderbird, both in standard and ESR releases. Vulnerable Firefox releases are all versions below 149, ESR releases below 115.34 and below 140.9, and Thunderbird releases below 149 or ESR below 140.9. All versions represented by the provided CPE strings fall under these ranges.

With a CVSS score of 10 the vulnerability is rated critical, and the EPSS score of less than 1% suggests low public exploit probability but does not diminish its severity. The flaw is not listed in CISA’s KEV catalog. Attacks likely involve malicious web content or email that triggers the integer overflow, leading to a full sandbox escape with attacker‑controlled code execution. Prompt remediation is essential to eliminate this high‑impact risk.