A critical mitigation bypass vulnerability in Mozilla Firefox and Thunderbird allows unauthenticated attackers to achieve total system compromise.

The flaw resides in the DOM Service Workers component, which fails to properly enforce security mitigations. An unauthenticated attacker can exploit this via the network without requiring user interaction to execute arbitrary code.

The CVSS score of 9.8 reflects the high risk posed by this vulnerability, as it allows for full confidentiality, integrity, and availability impact. Successful exploitation could lead to complete system compromise, unauthorized data exfiltration, and significant operational downtime for affected workstations or servers.

Immediate Action: Update all installations of Mozilla Firefox and Mozilla Thunderbird to version 153 or later immediately.

Proactive Monitoring: Review enterprise browser logs and endpoint security telemetry for unusual Service Worker activity or unexpected network traffic originating from browser processes.

Compensating Controls: While no direct virtual patch exists, ensure that endpoint detection and response (EDR) solutions are configured to monitor for anomalous child processes spawned by browser applications.

Public Exploit Available: Unknown

Given the critical CVSS severity and the potential for remote code execution without user interaction, this vulnerability represents an urgent threat to organizational security. IT administrators must prioritize the deployment of version 153 across all managed environments to eliminate the risk of exploitation.