The flaw allows an attacker to alter the name or other display information of files shown in the Downloads Panel of Firefox and Thunderbird. The vulnerability is categorized as CWE‑290, indicating a trust issue where an untrusted source can override trusted UI elements. Because the Downloads Panel is visible to all users, an attacker could mislead a user into interacting with a malicious or incorrectly labeled file, potentially enabling social engineering or further exploitation.

Mozilla Firefox releases prior to version 146 and the ESR 140.7 line, and Mozilla Thunderbird releases prior to version 146 and the ESR 140.7 line are affected. The vulnerability resides in the common Downloads Panel component used by both applications.

The CVSS score of 7.5 signals a moderate‑to‑high risk. The EPSS score of less than 1 % indicates that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is known. The likely attack vector is inferred to involve a malicious website or email that delivers a download through the client, presenting spoofed metadata at remote or local level. Until the fix is applied, users should verify the authenticity of downloads, especially those from untrusted sources.