When a file download is specified via a Content‑Disposition header, the header is ignored if the file is included in an embed or object tag. This oversight allows an attacker to inject malicious script into the page, leading to cross‑site scripting. The weakness is a form of script injection, identified as CWE‑79, where user‑supplied header data is processed without proper sanitization.

Mozilla Firefox versions prior to 140 and Firefox ESR 128.12, and Mozilla Thunderbird versions prior to 140 and Thunderbird ESR 128.12 are affected. The vulnerability may impact systems running these browsers, including installations on Red Hat Enterprise Linux 8, 9 and related extended roll‑up streams, as indicated by the CPE references. All affected browser instances should be evaluated for presence of the fault.

The CVSS score of 6.1 signals moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread attacks yet. Exploitation requires controlled web content that includes a downloadable file via embed or object tags, typically on sites that serve user‑uploaded media. An attacker with a malicious page or ability to influence webpage code could trigger the flaw to execute injected scripts in the victim’s browser session.