Mozilla Firefox and Thunderbird contain a critical memory corruption vulnerability in the WebIDL component that poses a severe risk of remote code execution.

This is a memory corruption flaw involving an invalid pointer within the DOM Bindings (WebIDL) component. The vulnerability is exploitable by an unauthenticated remote attacker who can trigger the flaw through malicious web content without requiring user interaction.

The CVSS score of 9.8 indicates a critical severity level, reflecting the potential for full system compromise. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the browser process, leading to sensitive data exfiltration, installation of malware, or total loss of system confidentiality, integrity, and availability.

Immediate Action: Update all instances of Mozilla Firefox and Thunderbird to the identified fixed versions (Firefox 153, ESR 115.38, ESR 140.13, or Thunderbird 153 and 140.13) immediately.

Proactive Monitoring: Review browser crash logs for recurring memory access violations or unusual heap activity which may indicate exploitation attempts.

Compensating Controls: Ensure that endpoint protection software is active and fully updated to detect malicious code execution patterns originating from browser processes.

Public Exploit Available: No (exploit_available: unknown)

Given the critical CVSS severity and the potential for remote code execution without user interaction, this vulnerability represents an urgent security risk. Organizations should prioritize the deployment of the provided patches across all workstations and servers running the affected Mozilla products to prevent potential exploitation.