A defect in the Networking: Cache component exposes internal cache data, allowing an adversary to read information that should remain confidential. The vulnerability can result in unauthorized disclosure of session data, cached credentials, or other sensitive content stored in the browser or email client. The weakness is a clear case of information exposure (CWE‑200) and directly compromises confidentiality, potentially aiding broader attacks if additional data is leaked.

Mozilla products are affected. Unpatched versions of Firefox and the ESR branch before 143 and 140.3, respectively, as well as Thunderbird before 143 and 140.3, are vulnerable. The vulnerability is present in the baseline builds that include the Networking: Cache component and has been addressed in the listed fixed releases.

The CVSS base score of 6.2 indicates medium severity, while the EPSS score of less than 1% shows the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, reducing the urgency for zero‑day exploitation. Attackers would need to trigger the vulnerable caching path, which may be local or via crafted network traffic; the description does not state an explicit remote exploitation vector, so the attack surface is considered limited. Patching removes the risk, and in the absence of an immediate fix, monitoring for abnormal cache reads is advised.