Arbitrary file deletion via uninstaller junction

Link following in Firefox before 116, Firefox ESR before 115.1, and Thunderbird before 115.1 allows local users to delete arbitrary files. The updater creates a directory writable by non-privileged users, and the uninstaller recursively deletes through an attacker-created Windows junction with the uninstalling account’s permissions. Exploitation requires local access, control of the writable directory, creation of a junction, and a higher-privileged user to uninstall the application.