A flaw in the Enterprise Policies component of Mozilla Firefox—and also in Thunderbird—allows a process to bypass normal permission checks and obtain higher privileges. The vulnerability is now fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

All Mozilla Firefox builds released prior to version 151 and all Firefox ESR builds released prior to 140.11, as well as all Thunderbird builds prior to version 151 and Thunderbird ESR builds prior to 140.11, are affected, regardless of the operating system in use.

The CVSS score is 8.8, EPSS score is 0.0003, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The advisory confirms that the flaw enables privilege escalation; however, the exact conditions required for exploitation are not disclosed, so the likelihood of successful exploitation cannot be quantified from the available data. The vulnerability also affects Thunderbird. The most reasonable inference is that the attack might involve local execution or a crafted Enterprise Policy file, but this is not explicitly stated.