A critical sandbox escape vulnerability in Mozilla Firefox and Thunderbird allows remote attackers to bypass security boundaries and access sensitive information.

This is an information disclosure and sandbox escape vulnerability within the Process Sandboxing component. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates that the vulnerability is remotely exploitable, requires no authentication, and results in a scope change with high confidentiality impact.

The ability to escape the browser sandbox is a severe security failure that allows attackers to potentially access data outside the browser's restricted environment. With a CVSS score of 8.6, this vulnerability poses a significant threat to organizational data security, as it facilitates unauthorized access to sensitive information on the host system.

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or the specified corrected version (e.g., 140.11) immediately.

Proactive Monitoring: Monitor host-level system logs for signs of unauthorized process interactions or attempts to access restricted file paths.

Compensating Controls: Use endpoint detection and response (EDR) tools to identify and block suspicious child processes spawned by the browser.

Public Exploit Available: Unknown

This is a critical vulnerability that requires immediate attention. Because the flaw allows for a sandbox escape, the potential for system-wide compromise is high. Administrators should deploy the required updates across all endpoints without delay to mitigate the risk of remote information disclosure.