Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability in the security component that could allow an attacker to bypass intended security constraints.

This vulnerability involves a flaw in the Security component that facilitates privilege escalation. The vulnerability requires user interaction (UI:R), typically occurring when a user visits a malicious site or opens a crafted message, allowing an attacker to escalate privileges within the application context.

Successful exploitation could allow an attacker to gain elevated privileges, potentially leading to full system compromise depending on the user's local permissions. With a CVSS score of 7.3, this flaw represents a significant risk to endpoint security, especially in environments where users have elevated system access.

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or later, or ensure the current version is within the patched 140.11+ range.

Proactive Monitoring: Monitor endpoint security logs for unexpected process execution or privilege changes associated with the browser or email client processes.

Compensating Controls: Enforce organizational policies that restrict the execution of browser-based scripts and utilize endpoint protection platforms (EPP) to detect malicious behavior triggered by browser exploitation.

Public Exploit Available: Unknown

Mozilla users should update their software to the latest stable versions immediately to remediate the privilege escalation flaw. Organizations should use centralized software management tools to ensure all endpoints are updated to a non-vulnerable version of Firefox and Thunderbird to maintain a secure posture.