Mozilla browsers and mail clients allowed users to change the values of JavaScript object properties that were intended to be non‑writeable. This flaw means that a malicious script could alter critical runtime data used by Firefox or Thunderbird, potentially compromising integrity, revealing private information, or enabling further code execution. The weakness falls under access control (CWE‑284) and incorrect handling of sensitive data (CWE‑591). Based on the description, it is inferred that a malicious script could manipulate these properties by executing JavaScript with sufficient privileges within the application.

Firefox versions prior to 144 and ESR 115.29/140.4, Thunderbird versions prior to 144 and ESR 140.4 are affected. Upgrades to the specified release numbers or later mitigate the issue.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is below 1 %, suggesting that exploitation activity is presently rare. It is not listed in the CISA KEV catalogue, so no documented exploits are known. Based on the description, it is inferred that ground‑truth exploitation would likely require an attacker to inject or run privileged JavaScript within the affected application; this represents a medium risk for end‑users who navigate the open Web. Organizations should consider the risk based on their exposure to untrusted content.