This vulnerability involves privilege escalation in the DOM: Navigation component of Mozilla Firefox. It was addressed and fixed in Firefox version 153. The CVSS 3.1 vector indicates it can be exploited remotely over the network with low attack complexity and no privileges required, but requires user interaction. Successful exploitation results in high impact on confidentiality, integrity, and availability. The Mozilla Foundation released an advisory (MFSA2026-68) detailing this and other vulnerabilities fixed in Firefox 153. The advisory confirms the fix and provides references to the underlying bug (Bug 2049181).

The vulnerability allows an attacker to escalate privileges within the Firefox browser, potentially leading to full compromise of the affected browser process. This can result in unauthorized access to sensitive information, modification of browser state, or disruption of browser availability. Given the high CVSS score (8.8), the impact is considered high on confidentiality, integrity, and availability of the affected system.

Mozilla has released an official fix for this vulnerability in Firefox version 153. Users and administrators should update affected Firefox installations to version 153 or later to remediate this issue. There are no indications that additional mitigations are required beyond applying the official update. For Thunderbird users, the fix is included in Thunderbird 153. Patch status is confirmed by the Mozilla Foundation Security Advisory MFSA2026-68.