A flaw in the Enterprise Policies component of Mozilla Firefox allows a process to bypass normal permission checks and obtain higher privileges. The description does not specify how the exploitation occurs, but the elevated authority could be used to alter browser configuration or install extensions with malicious intent.

All Mozilla Firefox builds released prior to version 151 and all Firefox ESR builds released prior to 140.11 are affected, regardless of the operating system in use.

The CVSS score is 6.5, EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The advisory confirms that the flaw enables privilege escalation; however, the exact conditions required for exploitation are not disclosed, so the likelihood of successful exploitation cannot be quantified from the available data. The most reasonable inference is that the attack might involve local execution or a crafted Enterprise Policy file, but this is not explicitly stated.