A flaw in the Safe Browsing component of Firefox allows an attacker to circumvent the browser’s protection mechanism, enabling malicious URLs or content to be accessed without triggering the usual safeguards. The vulnerability makes the Safe Browsing checks ineffective, potentially allowing phishing sites or malware downloads that would normally be blocked. Based on the description, the weakness likely involves improper validation of the Safe Browsing parameters, though the exact implementation flaw is not detailed in the alert.

Mozilla Firefox browsers running versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are impacted. Users of these releases are at risk until they upgrade to the patched versions where the Safe Browsing bypass is fixed.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that publicly known exploitation activity is either low or undocumented. Consequently, the measured severity is unknown, but the potential impact is significant because Safe Browsing is a core defense against malicious web content. Attackers would need to lure or trick users into visiting affected sites; the direct attack vector is therefore web‑based and could be exercised from any site that a user visits by using the default browser configuration. No public exploit code has been reported, but the lack of an EPSS score means the risk is not well quantified.