A flaw in the Graphics: WebRender component allows malicious content to bypass the normal privilege boundary between the rendering process and the rest of the browser, enabling an attacker to execute code with higher privileges than the user who runs Firefox or Thunderbird. The vulnerability is a CWE-266/CWE-269 flaw, where improper privilege management allows the escalation. If successfully exploited, the attacker can compromise both the integrity and confidentiality of the affected system and gain a foothold for further compromise.

The defect is present in all Mozilla Firefox releases earlier than version 150 and in all ESR releases prior to 115.35 and 140.10. It also affects Thunderbird versions older than 150 and ESR releases prior to the same 115.35 and 140.10 releases. Users who run those older binaries are susceptible until they upgrade to the patched versions.

The CVSS score of 8.8 indicates a high severity. The EPSS score of 0.00046 suggests a very low exploitation probability; however, the absence of a KEV listing means it is not known to be actively exploited by known threat actors. The likely attack vector involves the delivery of malicious content to the WebRender component through a web page or a local file, a scenario inferred from the nature of the component.