This vulnerability arises from an IPC (Inter-Process Communication) code flaw in Firefox on Windows, where a compromised child process can manipulate the parent process into returning a handle with excessive privileges. This handle misuse leads to a sandbox escape, breaking the intended security isolation. The issue was discovered following a similar sandbox escape vulnerability in Chrome (CVE-2025-2783). The vulnerability was exploited in the wild before being fixed by Mozilla in Firefox 136.0.4 and corresponding ESR versions.

Successful exploitation allows an attacker controlling a child process to escape the Firefox sandbox on Windows, potentially gaining elevated privileges and executing arbitrary code outside the sandbox restrictions. This compromises confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 10.0 (critical), reflecting network attack vector, no privileges required, no user interaction, and complete system compromise.

Mozilla has released official fixes for this vulnerability in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1. Users and administrators should update affected Firefox installations on Windows to these versions or later to remediate the issue. No additional mitigation is required once updated.