When Multi-Account Containers is activated, certain DNS queries can bypass an established SOCKS proxy if the domain name is invalid or the proxy is unresponsive. The compromised DNS traffic is therefore exposed to the local network, and based on the description, it is inferred that victim browsing activity and potentially the proxy endpoints could be revealed. This vulnerability is classified as an information exposure flaw (CWE‑200) and does not provide code execution or other destructive capabilities, but it can undermine user privacy and network security.

The issue affects Mozilla Firefox and Mozilla Thunderbird. Versions released before 140 are vulnerable; both products introduce a patch in version 140 that resolves the DNS tunneling defect.

The CVSS score of 8.6 positions this flaw in the high severity range, yet its EPSS score of less than 1% indicates a very low probability of being exploited in the wild. It does not appear in the CISA KEV catalog. An attacker likely needs to have a victim use a Multi‑Account Container with a misconfigured or down SOCKS proxy; based on the description, it is inferred that through this scenario the attacker can observe or later manipulate leaked DNS queries. Based on the description, it is inferred that the vulnerability operates from a client side, so the threat is limited to systems where the affected client and containers are in use.