The flaw in the WebCompat extension allows an attacker who enumerates its resource files to retrieve a UUID that is unique to the browser installation. This identifier remains the same across normal and private browsing modes as well as container instances, enabling continued tracking of the same browser even when the user switches profiles. Because the UUID persists at the browser level, the attacker can link multiple browsing sessions to a single user without requiring any active user involvement. This weakness is an information disclosure scenario, matching CWE-200.

Mozilla Firefox versions older than 140, including all ESR releases prior to 115.25 and 128.12, as well as Mozilla Thunderbird versions older than 140, including ESR 128.12. The vulnerability also affects systems that ship bundled packages of these browsers, such as Red Hat Enterprise Linux 8, 9, 10, and their variations, where the extension is preinstalled. Any device running one of these affected browsers is at risk unless the browser has been updated to a patched release.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of this analysis. It is not listed in CISA’s KEV catalog, which further reduces the perceived threat level. Attackers would need to identify the extension’s resources (a local or web-based enumeration step) and then read the UUID, after which they could use it to persistently identify the user across browsing contexts. No known public exploits have been reported, but the persistence nature of the data provides potentially significant privacy concerns.