Sandbox escape in the Profile Backup component of Mozilla Firefox and Thunderbird allows an attacker to break out of the application sandbox by manipulating backup data. The flaw is associated with CWE-653 (Untrusted File Content) and CWE-693 (Improper Authentication). If exploited, the attacker could execute arbitrary code with elevated privileges or compromise the confidentiality, integrity, and availability of the affected system.

All Mozilla Firefox releases prior to version 150.0.3, including ESR 115.36 and ESR 140.11, and Thunderbird versions before 140.11 are impacted. The issue was fixed in Firefox 150.0.3, ESR 115.36, ESR 140.11, and Thunderbird 140.11.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of < 1% suggests a low but non-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves processing a malicious backup file or triggering the backup functionality through an internal or remote debugging interface. If local or remote access to the user’s profile data is achieved, the attacker could potentially trigger the escape and execute code with elevated privileges.