The vulnerability arises from insufficient escaping of the ampersand character in the “Copy as cURL” feature, which allows an attacker to trick a user into executing a crafted command that can run arbitrary code locally. This flaw can lead to a complete compromise of the user’s system, exposing confidential data or allowing further malicious activity. The weakness is reflected in CWE‑116 and CWE‑77, indicating improper string handling and potential command injection.

Mozilla Firefox for Windows is affected, with the issue fixed in version 139 and Firefox ESR 115.24 and 128.11. Mozilla Thunderbird is also affected and was patched in version 139 and Thunderbird ESR 128.11. Users running older builds of these browsers face the risk of exploitation.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, further suggesting it has not been widely exploited. The attack requires user interaction to trigger the Copy as cURL command, making it a local, user‑dependent threat rather than a remote capability.