Mozilla Firefox and Thunderbird contain an undefined behavior flaw in the WebRTC signaling component that requires immediate patching to prevent unauthorized data access.

This is an undefined behavior vulnerability located in the WebRTC signaling component. Based on the CVSS vector (AV:N/AC:L/PR:N/UI:R), this flaw can be triggered by an unauthenticated remote attacker through a crafted interaction requiring user interaction.

The vulnerability carries a CVSS score of 8.1, indicating a high severity risk to the confidentiality and integrity of user data. Exploitation could allow an attacker to bypass security controls, leading to unauthorized information disclosure or modification within the browser or email client environment. Such incidents pose significant risks to organizational data privacy and user trust.

Immediate Action: Update all installations of Mozilla Firefox and Thunderbird to version 149 or 140.9 (ESR) or later to resolve the underlying undefined behavior.

Proactive Monitoring: Monitor browser and email client logs for unusual signaling patterns or unexpected crashes related to WebRTC processes.

Compensating Controls: Ensure that users are educated on the risks of interacting with untrusted web content or suspicious email attachments that may attempt to trigger WebRTC signaling vulnerabilities.

Public Exploit Available: No

Given the high CVSS score and the prevalence of Firefox and Thunderbird within enterprise environments, organizations should prioritize the deployment of these security updates. Failure to patch may expose workstations to remote exploitation, potentially leading to a breach of sensitive communications or credentials. Please verify that automatic updates are enabled or push the latest version via your centralized deployment management software immediately.