A flaw in the interprocess communication component permits a local attacker to elevate privileges on the system. The vulnerability stems from improper handling of permissions, allowing a compromised process to gain higher rights. This increase in authority can compromise confidentiality, integrity, or availability depending on the attacker’s objectives.

Mozilla products, specifically Firefox and Thunderbird, are affected. Versions prior to 149 of each product contain the flaw; the issue was addressed in Firefox 149 and Thunderbird 149. Users running older releases should verify their current version and apply updates accordingly.

The CVSS score of 8.8 reflects a high severity level, yet the EPSS score is below 1%, indicating a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be local, requiring an attacker with access to the user’s session or to the IPC mechanism. Exploitation would need to exploit the permission misconfiguration within the IPC subsystem to gain escalated privileges.