This vulnerability, identified in the DOM security component of Mozilla Firefox and Thunderbird, allows an attacker to bypass built‑in mitigation controls that are designed to enforce security boundaries within the browser environment. This exploit represents a CWE-693 weakness - a design flaw that permits a security boundary bypass due to insufficient enforcement of security policies - and a CWE-358 issue related to potential information leakage through improper logging. While the advisory does not detail downstream effects, the bypass undermines the intended isolation mechanisms of the DOM, potentially exposing the browser to higher‑risk exploitation when malicious content is rendered.

All versions of Mozilla Firefox and Thunderbird released prior to the specified updates are affected. The flaw is fixed in Firefox 151 and the Firefox ESR 140.11 branch, as well as in Thunderbird 151 and the Thunderbird ESR 140.11 release; versions equal to or newer than these contain the patch.

The CVSS score of 8.1 indicates a high severity risk, yet the EPSS score of less than 1 % suggests a low probability of public exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is delivery of malicious content via a web page or local file that exploits the DOM to leverage the bypassed mitigations, allowing an adversary to exploit weaknesses that should otherwise be restrained. Based on the description, this is inferred rather than explicitly stated.