Mozilla Firefox and Thunderbird WebChannel API Privilege Escalation Vulnerability

A vulnerability in the WebChannel API, used for inter-process communication, allowed for privilege escalation. The API accepted the sending principal without verification, potentially leading to unauthorized actions. This issue affects Firefox versions prior to 134, Firefox ESR versions prior to 128.6, Thunderbird versions prior to 134, and Thunderbird ESR versions prior to 128.6.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation.

Remediation

Users can upgrade to Firefox 134, Thunderbird 134, Firefox ESR 128.6, or Thunderbird ESR 128.6 to address this vulnerability.