A critical mitigation bypass vulnerability in the DOM Networking component of Mozilla Firefox and Thunderbird allows for potential unauthenticated remote code execution.

The vulnerability is a mitigation bypass within the DOM Networking component that can be triggered by an unauthenticated remote attacker. By exploiting this flaw, an attacker can bypass security controls to achieve full compromise of the affected client application.

The CVSS score of 9.8 reflects the high severity of this flaw, as it allows for unauthenticated remote exploitation with total impact on confidentiality, integrity, and availability. Successful exploitation could lead to full system compromise, sensitive data exfiltration, or the installation of malicious software on the victim's workstation. This poses a significant risk to organizational security and user privacy.

Immediate Action: Update all instances of Mozilla Firefox and Mozilla Thunderbird to version 153 or the ESR 140.13 release immediately.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from browser processes and review endpoint security logs for signs of unauthorized process injection.

Compensating Controls: While no direct WAF equivalent exists for client-side software, ensure that endpoint detection and response (EDR) solutions are active to identify and block suspicious child processes spawned by browser applications.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS severity and the nature of the flaw as a mitigation bypass, organizations must prioritize patching Firefox and Thunderbird installations across their environment. Failure to update promptly exposes users to significant remote attack vectors that bypass existing browser security protections. Ensure all systems are updated to the specified versions to fully remediate this vulnerability.