Technical impact
The advisory describes internally found bugs in Firefox ESR 153.0 and Firefox 153 that could lead to memory corruption or other security‑relevant defects. The developers believe that with enough effort some of these could have been exploited. No publicly disclosed exploits exist yet, but the potential for severe compromise remains due to the high CVSS score.
Affected Systems
Mozilla’s Firefox browser is affected, with security‑relevant defects present in Firefox ESR 153.0 and Firefox 153. The bugs could lead to memory corruption but the vulnerability was addressed in Firefox 154 and Firefox ESR 153.1. Similarly, Mozilla’s Thunderbird email client is affected in its 153 series and ESR 153.0 branch, with the fixes released in Thunderbird 154 and Thunderbird 153.1. Systems running any of these versions on any platform face the risk until they upgrade to the patched releases.
Risk and Exploitability
The CVSS score of 9.8 indicates a very high severity. The EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. Based on the description, it is inferred that the bugs could lead to memory corruption, but the advisory does not mention a publicly available exploit, so the likelihood of exploitation remains uncertain. No publicly disclosed proof‑of‑concept has been reported, which implies that exploitation risk is low but not zero.
