A critical sandbox escape vulnerability in Mozilla Firefox and Thunderbird allows for potential system compromise if an attacker successfully triggers the flaw via malicious web content.

This vulnerability involves a sandbox escape triggered by an integer overflow within the XPCOM component. The flaw is exploitable by an unauthenticated remote attacker who can induce a user to interact with malicious content.

The vulnerability carries a CVSS score of 8.6, indicating high severity. Successful exploitation allows an attacker to bypass the browser sandbox, which may lead to full system compromise, unauthorized data access, and the execution of arbitrary code with the privileges of the user running the application.

Immediate Action: Update Mozilla Firefox and Thunderbird to the identified fixed versions (149 or the specified ESR releases) immediately to patch the XPCOM component.

Proactive Monitoring: Monitor system logs for unusual crashes or unexpected process behavior associated with browser or mail client activity.

Compensating Controls: Ensure that browser-level security policies and endpoint protection software are active to detect or block malicious scripts attempting to leverage memory corruption vulnerabilities.

Public Exploit Available: Unknown

Given the potential for sandbox escape and subsequent arbitrary code execution, this vulnerability poses a significant risk to organizational endpoints. IT administrators must prioritize the deployment of the provided security updates across all instances of Firefox and Thunderbird to eliminate this attack vector.