Sandbox escape in Firefox DOM Navigation component

Successful exploitation could allow an attacker to escape the browser sandbox. In the broader Mozilla advisory context, sandbox escape may enable code or actions that would otherwise be constrained by the browser's sandboxing model, increasing the severity of a compromise and potentially facilitating privilege escalation or follow-on arbitrary code execution depending on the surrounding exploit chain and host context. The supplied content does not provide product-specific post-escape technical detail beyond sandbox escape.

No specific temporary workaround is provided in the supplied advisories. Until patching is completed, organizations can reduce exposure by applying least-privilege principles, avoiding administrative user contexts, restricting access to untrusted websites and content, and using exploit-protection and endpoint detection controls; however, vendor-recommended remediation is to update to a fixed release.

Upgrade affected products to a fixed version. The supplied content states the vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. Debian users should upgrade firefox-esr to the vendor-provided patched package version referenced in the advisory for their distribution.