The flaw stems from improper handling of "javascript:" URIs within cross‑origin frames, allowing content to execute in the top‑level document’s process instead of the intended sandboxed frame. This can lead to a sandbox escape where malicious code gains the privileges of the host process, potentially compromising both confidentiality and integrity of the system. The vulnerability is identified as CWE‑653 and is rated with a CVSS score of 9.1.

This issue affects Mozilla products, specifically Firefox and Thunderbird. The bulletin specifies that the security patch was released for Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10. Earlier versions of these browsers are thus vulnerable. There is no explicit mention of other vendors in the description, although the Common Platform Enumeration list includes various Red Hat products, the impact on them is not directly asserted.

The EPSS score of less than 1% indicates that exploitation is considered rare, and the vulnerability is not yet listed in CISA’s KEV catalog, implying no public exploits are known. The likely attack vector involves a user visiting a page or opening a message containing a cross‑origin frame that loads a "javascript:" URL; from there an attacker could coerce the host process to execute malicious code. Exact conditions for exploitation are not described beyond the use of such a URI, so the threat is generally limited to environments where arbitrary web content or email can be rendered without additional controls.