The vulnerability is a mitigation bypass in the DOM's security component, allowing an attacker to inject malicious script into pages rendered by Firefox or Thunderbird. Because the validation logic is circumvented, the injected JavaScript runs in the context of the victim’s browser, giving the attacker the ability to hijack or alter data, perform click‑jacking, or execute arbitrary code (CWE‑79).

Mozilla Firefox versions before 145 and Firefox ESR before 140.5, as well as Mozilla Thunderbird versions before 145 and Thunderbird ESR before 140.5 are affected. These are the mainstream and extended‑support editions widely used on consumer and enterprise systems.

The CVSS score is 8.1, indicating high severity, but the EPSS score is below 1 %, meaning the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger it by delivering a malicious web page or email that leverages the DOM; no elevated privileges or network access are required, and the exploitation is local to the user’s browser.