The vulnerability allows an attacker to manipulate the z‑order of browser or email client windows, enabling a fullscreen notification to be hidden from view. If the notification is suppressed, a user may unknowingly interact with a malicious page or email source while believing a legitimate fullscreen alert is present, potentially leading to spoofing or phishing attacks. The weakness is rooted in rendering order control (CWE‑1021) and misuse of system resource management (CWE‑451).

Mozilla Firefox and Mozilla Thunderbird applications are affected. Versions released prior to Firefox 135 and Thunderbird 135 contain the flaw; subsequent releases contain a fix and therefore are not vulnerable.

The CVSS score of 4.3 indicates a low severity, while the EPSS score indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed. Exploitation would likely require local access or the presence of malicious code running in the user’s environment; remote exploitation is not supported by the available data. The attack is best‑effort and depends on window‑management manipulation rather than remote code execution or privilege escalation.