The flaw allows a malicious script executed as a worker to bypass the browser’s same‑origin policy and access data or functionality that should be isolated between distinct origins. Based on the description, it is inferred that an attacker who can supply a malicious worker script may read sensitive data, hijack sessions, or execute unauthorized actions via cross‑origin interactions. This weakness is reflected in CWE‑346 (Access Control Issues) and CWE‑942 (Information Exposure Through Script).

The vulnerability affects Mozilla Firefox versions up to 144 and Firefox ESR up to 140.4, as well as Mozilla Thunderbird up to 144 and Thunderbird ESR up to 140.4. Any installation of these products that has not yet been updated to the patched version is vulnerable.

The CVSS score of 8.1 classifies this as a high‑severity flaw. Its EPSS score of less than 1% indicates a low probability of exploitation at present, and it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the most likely attack vector involves a malicious web page or corrupted email that creates a background worker, enabling the attacker to bypass the same‑origin policy without additional user interaction.