A flaw in the Security: Process Sandboxing component of Mozilla Firefox permits an unauthenticated attacker to read protected data and escape the sandbox. The vulnerability compromises confidentiality by exposing information that should be confined to a separate process and weakens the isolation guarantees of the browser, potentially enabling broader attacks such as data exfiltration or privilege escalation within the browser environment.

All installations of Mozilla Firefox that are older than version 151 or the extended‑support release 140.11 are affected. The issue was fixed in Firefox 151 and ESR 140.11, so upgrading to these or later releases removes the vulnerability.

No EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, so formal exploitation likelihood cannot be quantified. The CVSS score is 8.6, indicating a high severity. The attack vector is not explicitly described; it is inferred that exploitation would require the attacker to trigger a vulnerable code path within the browser’s sandbox, potentially via a malicious web page or compromised component. No known public exploits are reported.