The vulnerability allows an attacker to escape the sandbox boundary of the Responsive Design Mode component, granting the ability to execute code outside of the intended web browsing context and potentially gain higher privileges within the browser process.

Mozilla Firefox versions prior to 149 and ESR releases before 115.34, and Mozilla Thunderbird versions prior to 149 and ESR releases before 140.9 are affected. Users must procure Firefox 149 or later (or ESR 115.34 or later) and Thunderbird 149 or later (or ESR 140.9 or later) to block the issue.

The CVSS score of 9.6 indicates a critical severity, yet the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is local through the Responsive Design Mode developer interface, which may require interaction with the developer console or elevated privileges to activate. If exploited, arbitrary code execution within the browser context could compromise confidentiality, integrity, and availability of the user’s environment.