A flaw in the Security component of Mozilla Firefox allows a malicious actor to obtain higher privileges than intended, potentially enabling the execution of actions restricted to privileged users. This type of weakness can lead to unauthorized control over the system or the web browser, compromising confidentiality, integrity, and availability at the application level.

Any user running Mozilla Firefox versions prior to 151 or the ESR 140.11 release, or Mozilla Thunderbird versions prior to 151 or the ESR 140.11 release, is affected. The vulnerability applies to all platforms where these older releases are installed.

The CVSS score is 8.8, the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring the attacker to run malicious code within the browser context to exploit the privilege‑escalation path. Exploitation would require local code execution or a user to visit a malicious web page that triggers the flaw. The risk remains significant because elevated privileges can bypass security controls, but the absence of publicly reported exploitation or a known exploit reduces immediate threat yet mandates prompt remediation.