Thunderbird and Firefox execute `javascript:` URLs specified within `object` and `embed` tags, permitting an attacker to run arbitrary JavaScript code when the user opens a malicious email or web page. The flaw is a cross‑site scripting vulnerability (CWE‑80) that can lead to data theft, credential compromise, or further malware delivery.

This issue affects Mozilla Firefox version 141 and earlier, Firefox ESR 128.13 and ESR 140.1, as well as Mozilla Thunderbird 141 and earlier, Thunderbird ESR 128.13 and ESR 140.1. Red Hat Enterprise Linux 8, 9, and 10 packages that include these browsers are also potentially impacted until they apply the corresponding updates.

The vulnerability has a CVSS score of 8.1, indicating high severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. It is not listed in the CISA KEV catalog. Attackers can exploit the bug by embedding a `javascript:` URL in an `object` or `embed` tag within an email or web page; when a user opens it, the browser executes the script with the privileges of the user. This client‑side attack does not require additional network access or special user privileges beyond normal usage of the affected applications.