A critical mitigation bypass vulnerability in Mozilla Firefox and Thunderbird allows unauthenticated attackers to compromise affected systems with full access to confidentiality, integrity, and availability.

This vulnerability resides in the PDF Viewer component and functions as a mitigation bypass, which can be triggered by an unauthenticated remote attacker via a specially crafted document.

The flaw carries a CVSS score of 9.8, indicating a critical risk to organizational infrastructure. Successful exploitation may lead to full system compromise, unauthorized data exfiltration, and significant operational downtime, necessitating immediate remediation to maintain the security posture of endpoints and mail clients.

Immediate Action: Update Mozilla Firefox and Thunderbird to version 153 or the ESR version 140.13 immediately.

Proactive Monitoring: Monitor network traffic and endpoint logs for abnormal browser or mail client behavior, particularly involving the loading of PDF content from untrusted sources.

Compensating Controls: Deploy network-level security controls to restrict access to known malicious domains and utilize endpoint protection platforms to detect and block suspicious process execution originating from browser or mail client components.

Public Exploit Available: No

Given the critical CVSS severity and the nature of the component affected, this vulnerability represents a high-priority risk. Security teams must prioritize patching all instances of Firefox and Thunderbird across the enterprise to version 153 or 140.13 to prevent exploitation of this mitigation bypass.