This vulnerability is an authentication forgery flaw (CWE‑290) that can allow an attacker to spoof another user’s identity within the Mozilla Firefox browser. The flaw was identified as a spoofing issue and carries a CVSS score of 3.4, indicating a low‑severity risk. While it does not enable arbitrary code execution or a denial‑of‑service condition, it can undermine user trust in web interactions and potentially compromise the integrity of data transmitted or verified by the browser.

Mozilla Firefox users are affected if they are running any version older than Firefox 145 or the corresponding ESR releases that were fixed (ESR 140.5 and ESR 115.30). The attack does not depend on a specific vendor or third‑party product beyond the Firefox browser itself. Users of these older Firefox builds should verify whether they are still supported by Mozilla and plan for an upgrade accordingly.

The CVSS score of 3.4 indicates a low baseline impact, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description and the nature of the flaw, the likely attack vector involves a malicious web page or content that tricks the browser into treating a forged identity as genuine. Although the exact prerequisites for exploitation are not detailed, the effect would be limited to scenarios where the attacker can influence or load content within a user’s Firefox session.