The vulnerability is a timing-dependent race condition in the XPConnect component that allows a privileged entity to escape the application sandbox. Attackers can exploit this flaw to gain privileges beyond the intended sandbox boundaries, enabling arbitrary code execution with the permissions of the browser or email client. This represents a severe compromise of confidentiality, integrity, and availability, as malicious code can read, modify, or delete local data and system files.

Mozilla Firefox and Mozilla Thunderbird prior to version 156 are affected. Versions 156 and newer contain the official patch that eliminates the race condition.

The CVSS score of 9.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a currently low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be a malicious or compromised web page, email attachment, or script that manipulates execution timing within the XPConnect interface. Precise timing conditions are required, but once triggered, the sandbox escape can lead to system compromise.