A clickjacking flaw allowed a malicious site to trick a user into revealing the contents of saved payment card data that resides in the browser or email client. The weakness enables an attacker to read confidential payment details if the user interacts with a manipulated interface, which is classified as a User Interface API Dependency Error (CWE‑1021).

Mozilla Firefox and Thunderbird are affected. The flaw was fixed in Firefox 139 and Firefox ESR 128.11, as well as in Thunderbird 139 and Thunderbird ESR 128.11. Versions older than these are vulnerable.

The exploit requires the user to visit or interact with a malicious page that loads the vulnerable UI in an iframe or similar technique. Because the attack depends on user interaction, it does not allow remote code execution; the impact is limited to a confidentiality breach of locked‑in payment information. The CVSS score of 5.4 indicates moderate severity, while the EPSS of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Consequently, the overall risk in an enterprise setting is moderate, with the primary threat being an inadvertent disclosure of stored card details.