This vulnerability permits code to escape the sandbox of the Responsive Design Mode component, allowing an attacker to execute arbitrary code on the host. An attacker can compromise the integrity and confidentiality of the system by injecting and running malicious scripts that bypass the browser or email client’s protected environment. The impact can span from local privilege escalation to full remote code execution depending on the context in which the vulnerable component is used.

Affected products are Mozilla Firefox and Mozilla Thunderbird. The vulnerability exists in Firefox releases older than version 149, and in Firefox ESR versions older than 115.34 as well as older than 140.9. In Thunderbird the same version thresholds apply: all releases prior to 149 or ESR versions prior to 140.9 are vulnerable.

The CVSS score is 9.6, indicating critical severity. EPSS is below 1% and the issue is not listed in the CISA KEV catalog, suggesting low current exploit activity, but the potential for abuse remains. Exploitation requires loading malicious web content or email that triggers Responsive Design Mode, so likely needs a user to visit a crafted site or open a mail attachment. Because the flaw is a sandbox escape, standard browser isolation mechanisms are insufficient, making the attack straightforward once the vulnerable component is activated.