Mozilla’s copy as cURL functionality does not escape certain special characters properly, allowing an attacker to embed malicious code into the generated command string. If a user copies that command and executes it in a terminal or shell, the payload can run with the user’s privileges, resulting in local code execution on the host system. This breach would give the attacker full control over the compromised machine, enabling further attack steps such as persistence, data exfiltration, or lateral movement. The flaw represents a classic instance of CWE-138 (Improper Escaping of Special Characters) and CWE-77 (OS Command Injection).

The vulnerability affects Mozilla Firefox and Mozilla Thunderbird browsers. Both products were patched in their 138th release, rendering all versions prior to 138 susceptible to the flaw. No other browsers or products are known to be impacted.

The CVSS score of 5.1 places the weakness in the medium severity band, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. Because the attack requires a user to run the copied command, it relies on social engineering; an attacker must first lure a user into executing the code. The vulnerability is not listed in CISA’s KEV catalog. Nonetheless, local code execution represents a high‑impact outcome for the affected user and should not be dismissed.