A malicious web page could exploit the ability of an OBJECT tag to override the default browser interpretation of a resource that lacks a Content‑Type header. The flaw allows the attacker to specify a type that causes the browser to handle the payload as executable JavaScript, enabling the injection of scripts into the browsing context. This can lead to the theft of data, session hijacking, or other malicious actions within the scope of the affected web site.

The vulnerability exists in Mozilla Firefox up to version 143, the ESR series before 140.4, and in Mozilla Thunderbird up to version 143 and ESR before 140.4. All versions prior to the fixes referenced (Firefox 144, ESR 140.4, Thunderbird 144, ESR 140.4) are impacted.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1 % suggests a low overall exploitation probability. The flaw is not listed in CISA’s KEV catalog. An attacker would need to supply an OBJECT tag pointing to a resource served without a Content‑Type header, typically on a site that does not enforce proper MIME type headers, to trigger the exploit. If such a site exists, the risk is limited to the affected origin but can be amplified if multiple resources are served without type information.