This vulnerability arises from a flaw in the DOM Workers component of Mozilla’s browsers, allowing malicious web content to elevate its privileges within the Document Object Model. By exploiting this weakness, an attacker can execute scripts with higher privileges than the normal sandboxed web environment permits, which could compromise confidentiality, integrity, or availability of the user’s data and the browser itself. The flaw is mitigated by updates in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird ESR 140.11.

All users running Mozilla Firefox or Thunderbird versions prior to the patched releases are affected. This includes standard releases before Firefox 151 and Thunderbird 151, as well as the ESR lines before Firefox ESR 140.11 and Thunderbird ESR 140.11.

The EPSS score is < 1 %, indicating a low likelihood of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The CVSS score of 8.8 reflects high severity. Exploitation would likely require a crafted web page that targets the Workers component; no additional remote code execution beyond the compromised page is described. While publicly known exploits are currently lacking, the privilege‑escalation potential warrants timely remediation.