This vulnerability permits files bearing a terminal extension to be opened in Firefox on macOS without the standard warning that flags executable content. Since the terminal extension is commonly linked to scripts or binaries, an attacker could deliver a terminal file that, when opened, could lead to the execution of arbitrary code. The information provided does not explicitly confirm whether the file is executed automatically, but based on the nature of the extension, code execution is a realistic and potentially severe outcome. The weakness is aligned with CWE‑345, which addresses information exposure that can lead to execution of malicious content.

The issue is limited to Mozilla Firefox and Mozilla Thunderbird running on macOS, affecting versions prior to Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. Other operating systems and non‑macOS builds of these browsers are not affected.

The CVSS base score of 8.8 indicates a high severity, while the EPSS score of < 1% reflects limited current exploitation activity. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a malicious terminal file through channels such as email attachments, compromised websites, or infected downloads, with the user incorrectly opening the file on their macOS system.