The vulnerability involves a bypass of the DOM‑level security component in Mozilla products. It represents a failure of a protection mechanism (CWE‑693), meaning that security checks that the browser normally applies to web content could be circumvented. The issues were addressed in Firefox 151 and Thunderbird 151. The description does not disclose how an attacker might leverage this to gain elevation or persistence, so the precise impact on confidentiality, integrity, or availability is unknown beyond the potential for compromised web content to escape normal checks.

Mozilla Firefox and Mozilla Thunderbird releases older than version 151 are affected. The fix was applied in Firefox 151 and Thunderbird 151, so any installation of these products at or below 150.x (or earlier) remains susceptible to the DOM mitigation bypass.

The CVSS v3 score of 8.1 classifies the flaw as high severity, though no EPSS value is available and the vulnerability is not listed in the CISA KEV catalog. The description does not detail exploitation evidence, and the attack vector is not explicitly described; the likely attack vector is malicious web content presented to a user, but this is inferred. The vulnerability may allow an attacker to bypass browser‑based mitigations, but because exploitation details are not disclosed, the real‑world risk remains uncertain.