An attacker can manipulate subdocuments to bypass the connect-src directive of a Content Security Policy. This bypass allows the attacker to initiate arbitrary network connections from the affected application, potentially exfiltrating data or communicating with malicious servers without the browser’s usual enforcement. The vulnerability also conceals these connections from the Network tab in DevTools, making detection harder. The weakness is characterized by CWE‑693, which deals with compromised control flow integrity or validation concerns.

Mozilla Firefox and Mozilla Thunderbird versions prior to 140 are affected. The fix is implemented in Firefox 140 and Thunderbird 140, so any installation older than those releases is vulnerable.

The CVSS score of 9.1 indicates very high severity. The EPSS score of less than 1 % suggests that, as of now, exploitation is unlikely, and the vulnerability is not listed in CISA’s KEV catalog. However, once exploitation becomes possible, the lack of browser-enforced protection could enable malicious scripts to connect to arbitrary domains, potentially compromising confidentiality and integrity of data transmitted by the affected products.