Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156.
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.