The CVE describes a Same‑Origin Policy bypass in the browser’s DOM Notifications component. This weakness could allow an attacker who can deliver malicious content to a user to access notification data that was intended to be isolated to the originating domain. The result is potential information disclosure or manipulation of notifications, impacting confidentiality and integrity of user data within the browser environment.

The defect is present in Mozilla Firefox and Mozilla Thunderbird browsers built on the shared Notification API. The issue has been fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird ESR 140.5. Versions prior to these fixed releases are affected unless explicit patching is applied.

With a CVSS base score of 8.1 the vulnerability is considered high severity, yet the EPSS score is under 1 %, indicating a low probability of widespread exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would typically need to entice a user to visit a malicious web page or local file that triggers the Notifications component, after which cross‑origin notification data could be read or altered. The overall risk is high for susceptible installations, but the likelihood of active exploitation remains small.