A flaw in the developer tools caused the preview of network responses to ignore the Content‑Security‑Policy headers that would normally restrict what content can be displayed or executed. Because CSP was bypassed, a malicious page could have caused the browser to load or execute attacker‑controlled resources when a developer inspected responses in the network panel, leading to potential script injection or other content‑injection attacks within the user’s browser context.

Mozilla products affected by this issue include Firefox and Thunderbird. All releases prior to version 139 are vulnerable; the vulnerability was corrected in Firefox 139 and Thunderbird 139. Users who continue to use older builds are at risk.

The severity of the flaw is reflected in a CVSS score of 6.5, indicating moderate risk. The EPSS score of less than 1 % suggests the probability of widespread exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a compromised or malicious web page that, when inspected by a developer using the network preview tool, triggers the injection of content bypassing CSP. No privilege escalation or remote code execution outside the browser session is described, and the vulnerability appears confined to the client‑side developer tools environment.