A flaw in Firefox and Thunderbird’s Devtools lets a user save network responses using the Save As option without appending the .download extension. If the original resource was an executable, the file may be saved with a misleading extension and executed inadvertently. This weakness enables local execution of malicious code by exploiting the user’s interaction with the browser’s developer tools. The flaw is identified as CWE‑434, reflecting improper handling of untrusted content that can become executable.

The vulnerability affects Mozilla Firefox and Thunderbird versions prior to 140. Users running Firefox 139 or earlier and Thunderbird 139 or earlier are susceptible when they use the Devtools network panel to save responses. Newer releases include a fix that forces the .download extension.

With a CVSS score of 8.1, the flaw is assessed as high severity, but the EPSS score of less than 1 % indicates a low likelihood of widespread exploitation. It is not listed in CISA’s KEV catalog. The attack requires a local user to open Devtools and save a response, making it a local, user‑initiated vector. Successful exploitation can lead to the execution of arbitrary code on the affected machine.