The Remote Settings Client component in Mozilla Firefox contains a flaw that allows an attacker to elevate privileges. When exploited, the vulnerability can give an attacker higher level access than intended, potentially compromising the integrity and confidentiality of the user’s browser session and the system it runs on. The weakness is a form of privilege computation or access control error, enabling unauthorized operations without adequate permission checks.

Mozilla Firefox is affected, specifically versions 154 and all active ESR releases: Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. Clients running these versions or prior lack the required patch to mitigate the flaw.

The CVSS score is not provided in the available data, and the EPSS score is unavailable, indicating no published exploitation probability. The vulnerability is not listed in the CISA KEV catalog as of the current information. Based on the component name and typical behavior, it is inferred that the attack vector could be remote, requiring the attacker to supply crafted Remote Settings data. Without a patch, an attacker who successfully exploits the flaw could gain elevated permissions, though the exact conditions and impact scope would depend on the specific system configuration.