A critical site isolation flaw in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to achieve total system compromise.

This is a site isolation vulnerability within the Networking component that can be triggered by an unauthenticated attacker. The flaw resides in the handling of web content isolation, which, if exploited, permits unauthorized access to sensitive data or control over the application.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Successful exploitation could lead to total loss of confidentiality, integrity, and availability, potentially resulting in unauthorized data exfiltration, remote code execution, and significant reputational damage to the organization.

Immediate Action: Update Mozilla Firefox and Thunderbird to version 153 or the ESR version 140.13 immediately to apply the vendor-provided security patches.

Proactive Monitoring: Monitor network traffic for anomalous patterns originating from or directed toward browser-related processes and review security logs for unexpected process execution.

Compensating Controls: Deploy endpoint protection solutions capable of detecting unauthorized memory access and utilize browser security policies to restrict cross-site data sharing where possible.

Public Exploit Available: No — exploit_available (false).

Given the critical severity of this vulnerability and the potential for total system compromise, immediate patching is required. Organizations should prioritize updating all instances of Firefox and Thunderbird across their infrastructure to the specified fixed versions to eliminate this high-risk attack vector.