The HTTPS-Only exception page in Firefox and Thunderbird lacked an anti-clickjacking delay, allowing an attacker to craft a page that tricks a user into granting a non-HTTPS exception. This could lead to the browser loading the site over HTTP, exposing the user to data interception, credential theft, or other downgrade attacks. The weakness corresponds to CWE-1021, a user interface manipulation flaw that requires user interaction to be exploited.

Mozilla Firefox and Mozilla Thunderbird versions prior to 140 were impacted. The vulnerability was fixed in Firefox 140 and Thunderbird 140, so any release before these versions is considered vulnerable.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1 % shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. Exploitation requires a user to interact with a maliciously crafted page that presents the exception screen; once the user clicks to accept the exception, the browser will load the HTTP site, potentially enabling further attacks.