The vulnerability permits an attacker to bypass built‑in DOM mitigations, allowing injection of malicious scripts into web content understood by Firefox or Thunderbird. This bypass is triggered by malformed HTML or JavaScript that is otherwise sanitized, giving an attacker the ability to execute arbitrary code within the context of the application. The weakness is captured by CWE-79 and CWE-288, indicating improper input validation leading to cross‑site scripting and potential denial of service.

The flaw affects Mozilla Firefox and Mozilla Thunderbird across both the main releases and ESR streams. Versions fixed in the vendor advisories are Firefox 145, ESR 140.5, ESR 115.30 and Thunderbird 145, Thunderbird 140.5. The data does not list the earliest affected releases, so any older build may be vulnerable; it is recommended to target installations below those versions for patching.

The CVSS score of 6.1 indicates a medium severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a malicious web page or web application that the user visits, where the bypass allows the injected payload to run. The impact extends to confidentiality, integrity, and availability of the compromised system if the attacker carries out privilege escalation scripts or Post‑Message attacks.