This vulnerability arises when the routines that handle execution errors are incorrectly isolated from web content. A crafted page can trigger those routines and expose data that belongs to another origin. The flaw can leak sensitive information but does not permit arbitrary code execution or modification of system state. The weakness is aligned with CWE‑346 (Untrusted Content as Source) and CWE‑829 (Improper Restriction of Execution Graph).

Mozilla Firefox and Mozilla Thunderbird are impacted. Versions before Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11 and before Thunderbird 139, Thunderbird ESR 128.11 are vulnerable. Packages from Red Hat Enterprise Linux 8, 9, and associated RHEL derivatives that include these browsers also require attention.

With a CVSS score of 4.3 the issue is low severity, and an EPSS of < 1 % signals a very small chance of exploitation. It is not present in the CISA KEV catalog. The attack vector is not documented in the advisory; however, the description suggests that a malicious or compromised web page would be needed to provoke the vulnerable error‑handling path. Because no privilege escalation is required, the risk is mainly limited to unintended information disclosure.