jar: URLs are used to retrieve local file content packaged in a ZIP archive. The vulnerability lies in the interpretation of null bytes and the following fake extension: when a jar URL contains a null byte followed by a fake extension, the null byte and the following content are ignored when retrieving the archive, but the fake extension is used to determine the type of content. This allows malicious code to be concealed inside a file that appears to be an image or other benign content, enabling the code to be executed by the browser as part of a web extension. The impact is the ability for an attacker to execute arbitrary code within the browser context or through a malicious extension, potentially compromising the confidentiality, integrity, or availability of the user’s system.

Mozilla Firefox prior to version 136 (or ESR 128.8) and Mozilla Thunderbird prior to version 136 (or ESR 128.8) are affected. The issue arises when a browser loads a jar: URL from a web extension or other source. Operating systems such as Red Hat Enterprise Linux, though listed as CPEs, are not directly impacted unless they run the affected browsers. Systems using the affected browser versions should upgrade to the patched releases to eliminate the vulnerability.

With a CVSS score of 7.3 the vulnerability is classified as high severity. The EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not yet recorded in the CISA KEV catalog. Exploitation requires the attacker to supply a jar: URL that contains a null byte followed by a fake extension, typically within the context of a malicious or compromised web extension. The attacker must have the ability to deliver or install that extension, so the attack surface is limited to users who install extensions or visit sites that can define such URLs. While the risk is not trivial, the likelihood of widespread exploitation remains low under the current conditions.