The vulnerability arises from improper removal of username and password information from URLs in Content Security Policy (CSP) violation reports, allowing attackers to capture HTTP Basic Authentication credentials. This flaw can compromise user confidentiality by exposing account credentials to malicious actors, increasing the risk of account takeover or broader system compromise. The weakness is categorized as CWE‑276, indicating incorrect assignment or handling of sensitive information.

Mozilla browsers, specifically Firefox versions prior to 141, Firefox ESR 128.13 and 140.1, and Thunderbird versions prior to 141, Thunderbird ESR 128.13 and 140.1, are impacted. Any system running these browser builds, including installations on Red Hat Enterprise Linux 8, 9, or 10 environments, may be vulnerable.

The CVSS score of 9.8 classifies this as a critical vulnerability, yet the EPSS score of less than 1% points to a low current likelihood of exploitation. It is not listed in CISA’s KEV catalog. The likely attack scenario involves a remote attacker serving a malicious web page that triggers a CSP violation, causing the browser to generate a report that inadvertently exposes credentials. Once exposed, the attacker could obtain and use the victim's authentication tokens to access protected resources.