This vulnerability involves a mitigation bypass in the Document Object Model (DOM) security component of Mozilla Firefox. It allows an attacker to circumvent security mitigations, potentially leading to high-impact consequences such as unauthorized access or code execution. The issue was addressed and fixed in Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird 140.12. The CVSS v3.1 score of 9.1 reflects a network attack vector with low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. The Mozilla advisories MFSA2026-57 and MFSA2026-58 provide detailed information and confirm the remediation.

The vulnerability allows an attacker to bypass security mitigations in the DOM security component, which can lead to unauthorized disclosure of information and modification of data (high confidentiality and integrity impact). The CVSS score of 9.1 classifies this as a critical vulnerability. There are no known exploits in the wild at the time of publication.

A fix is available and has been officially released by Mozilla. Users and administrators should upgrade to Firefox 152 or later, or Firefox ESR 140.12 or later, to remediate this vulnerability. The vendor advisories at https://www.mozilla.org/security/advisories/mfsa2026-57/ and https://www.mozilla.org/security/advisories/mfsa2026-58/ provide authoritative guidance and confirm the fix status.