A flaw in the Security: Process Sandboxing component allows an attacker to read protected data and escape from the sandbox. The vulnerability exposes information that should be confined to a separate browser process, compromising confidentiality and weakens the isolation guarantees that separate processes provide. The issue is fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

All installations of Mozilla Firefox that are older than version 151 or the extended‑support release 140.11 and all installations of Mozilla Thunderbird that are older than version 151 or the ESR 140.11 are affected. The issue was fixed in Firefox 151 and ESR 140.11, and Thunderbird 151 and ESR 140.11, so upgrading to these or later releases removes the vulnerability.

The EPSS score of 0.00044 indicates an extremely low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so formal exploitation likelihood cannot be quantified. The CVSS score is 8.6, indicating a high severity. The attack vector is not explicitly described; it is inferred that exploitation would require the attacker to trigger a vulnerable code path within the browser’s sandbox, potentially via a malicious web page or compromised component. No known public exploits are reported.