A critical integer overflow vulnerability in the Mozilla WebAssembly component allows unauthenticated attackers to achieve remote code execution, necessitating immediate patching.

This flaw involves an integer overflow within the JavaScript WebAssembly engine. The vulnerability is exploitable by an unauthenticated remote attacker with no user interaction required.

The CVSS score of 9.8 reflects the critical severity of this flaw, as it permits full compromise of the confidentiality, integrity, and availability of the affected system. Successful exploitation could lead to unauthorized code execution on the host machine, potentially resulting in data exfiltration, installation of malware, or total system takeover.

Immediate Action: Update Mozilla Firefox and Thunderbird to version 153 or the ESR version 140.13 immediately to apply the vendor-provided security patches.

Proactive Monitoring: Review enterprise browser and mail client logs for unusual process execution patterns or unexpected network traffic originating from the affected applications.

Compensating Controls: While no direct virtual patch exists for this memory corruption, ensuring that endpoint protection software is active and restricted execution environments are utilized can reduce the risk of successful exploitation.

Public Exploit Available: Unknown.

Given the critical CVSS score of 9.8 and the ease of exploitability (no user interaction, no authentication), organizations must prioritize this update as a high-urgency task. Deploy the recommended software versions across all managed endpoints to mitigate the risk of remote compromise.