The flaw originates from the handling of XSLT documents, where the source document is not properly propagated, allowing the content to circumvent the application's Content Security Policy. This is a protection mechanism failure (CWE‑693). An attacker could supply a crafted XSLT file that would run privileged actions or inject malicious scripts, effectively breaking the controls provided by CSP.

Mozilla Firefox and Mozilla Thunderbird, affecting all releases prior to Firefox 141, Thunderbird 141, and all versions older than the ESR 128.13 and ESR 140.1 fixed releases of both browsers.

The CVSS score of 8.1 indicates a medium‑high severity vulnerability. An EPSS score of less than 1 % shows a low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Likely attack vectors involve an attacker delivering a malicious XSLT document via a web page or email attachment, which would bypass CSP enforcement. No public exploit is known, but the potential impact remains significant.