This flaw allows an attacker to manipulate the Site Permissions user interface in Firefox and Thunderbird, causing the browser to present falsified permission prompts. The vulnerability is classified as CWE‑79, indicating potential for cross‑site scripting, which can lead to spoofing of trusted permissions. The impact is primarily the deception of users into granting or reviewing permissions under false pretenses, compromising the integrity of the browser's permission model.

Mozilla Firefox and Mozilla Thunderbird browsers are impacted. All releases prior to version 143 of each product contain the vulnerability; the flaw was addressed in the 143 update.

The CVSS score of 8.1 classifies the issue as high severity, yet the EPSS score of less than 1 % indicates a low current exploitation probability. The vulnerability has not been listed in the CISA KEV catalog. Likely exploitation would involve delivering a crafted website that manipulates the Site Permissions component, but the attack requires the user to visit such a malicious site or click a link containing the crafted payload. Based on the description, it can be inferred that the attack vector is web‑based with user interaction as a prerequisite.