A flaw in the Debugger component of Mozilla Firefox and Thunderbird provides a privilege escalation path. The description notes that the bug allows an attacker to gain higher privileges within the same process, but it does not disclose the precise mechanism. The issue is classified as CWE-266, improper privilege management, and CWE-269, inadequate privilege enforcement. If exploited, an attacker could modify the application’s behavior, access sensitive data, or execute arbitrary code with the privileges of the target process.

Mozilla Firefox versions released before 150 and the ESR 140.10 branch are affected, as are Thunderbird releases before 150 and ESR 140.10. Installers or builds that do not include the patches delivered in those releases remain vulnerable.

The CVSS score is 8.8, indicating a high impact if exploited. The EPSS score is less than 1%, suggesting a very low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves a user or process that can invoke or manipulate the debugger – for example, a malicious add‑on with debugger privileges, or an extension that uses the remote debugging API. Deployments that expose the debugger interface to untrusted users or applications therefore face a higher risk.