A web page could trick a user into setting that site as the default handler for a custom URL protocol. Based on the description, it is inferred that an attacker could employ clickjacking techniques to cause the registration to happen without genuine user intent, giving the attacker the ability to hijack URLs targeted to the custom protocol. This results in an unauthorized capability that could be abused to direct traffic or manipulate user interactions.

Systems affected include Mozilla Firefox and Mozilla Thunderbird, specifically any versions prior to Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. Linux distributions that bundle these browsers, such as Red Hat Enterprise Linux 8 and 9 and their extended support releases, are also impacted when they run the vulnerable browser versions.

The CVSS score is 4.3, indicating moderate impact, while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation. The likely attack vector, inferred from the description, requires a user to visit a malicious web page that uses clickjacking to bypass the default handler prompt; no remote code execution is required.