A flaw in the request handling component allows a requester to bypass the same‑origin policy that normally restricts cross‑domain network traffic. This can enable an attacker to craft requests that are interpreted as originating from a trusted domain, potentially exposing confidential data or executing scripts in a privileged context. The weakness corresponds to CWE‑346, which involves insufficient validation of the origin of requests. The impact is limited to services that rely on the request handling logic; if exploited, the attacker could read or modify data that should be protected by the same‑origin constraint.

The vulnerability affects Mozilla Firefox and Mozilla Thunderbird. The specific affected releases are Firefox 145 and earlier, Firefox ESR 115.30 and earlier, Firefox ESR 140.5 and earlier, Thunderbird 145 and earlier, Thunderbird ESR 115.30 and earlier, and Thunderbird ESR 140.5 and earlier. All of these fall within the product lines named Mozilla:Firefox and Mozilla:Thunderbird as listed by the CVE Numbering Authority.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is through web content that can trigger the request handling component; an attacker would need to persuade a victim’s browser to initiate a crafted request. Given the low EPSS, potential impact may be limited to isolated systems unless a widespread exploit emerges.