A vulnerability causes script elements that load resources from other origins to emit load and error events that leak status information. This leakage can be exploited to perform XS‑Leaks attacks, allowing an attacker to discover whether a cross‑origin resource exists, its status, or whether a request succeeded or failed. The primary consequence is unauthorized disclosure of information about remote resources, which could assist in crafting further attacks. The weakness is classified as CWE‑200 (Information Exposure).

Mozilla Firefox before version 139 and Firefox ESR before 128.11 are affected, as are Mozilla Thunderbird before version 139 and Thunderbird ESR before 128.11. No specific Red Hat product versions are directly cited as vulnerable, but the listed CPEs imply broader system compatibility for these packages.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests the probability of exploitation is very low at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a malicious web site that hosts a script element pointing to a cross‑origin resource; the attacker can then observe the emission of load or error events to infer status information. No privilege escalation or code execution is possible, but the disclosed information could assist in other phishing or reconnaissance activities.