A compromised web process can send malicious IPC messages that cause the privileged browser or email client process to unintentionally expose blocks of its memory to the attacker. This results in a confidential data breach where sensitive information residing in the main process becomes visible to the malicious process, violating the principle of least privilege. The flaw is a classic confidentiality weakness, classified as CWE-200 and related to improper handling of IPC messages (CWE-497).

The vulnerability affects Mozilla’s products: Firefox (including standard and ESR releases) and Thunderbird. Versions vulnerable are Firefox 144, Firefox ESR 115.29, and Firefox ESR 140.4, as well as Thunderbird 144 and Thunderbird 140.4.

The CVSS score of 9.8 marks this flaw as critical, and the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be local or user‑attributed: a malicious web process, potentially originating from compromised or malicious web content, leverages inter‑process communication protocols to trigger the memory‑leak scenario. Attacks would require the attacker to exploit an in‑browser context or the user's local environment to gain initial access to the web process.