The vulnerability enables malicious sites to conduct DNS rebinding, causing the browser to cache CORS preflight responses across IP address changes. This caching allows the site to send cross‑origin requests that would normally be blocked by the browser’s CORS policy. The consequence is that the attacker can access resources or perform actions on a target origin that the origin intends to protect through CORS, potentially exposing data or functionality meant to be restricted to its own domain.

Mozilla Firefox and Thunderbird, all standard and ESR releases prior to Firefox 141 (including ESR versions below 140.1) and Thunderbird prior to 141 (including ESR versions below 140.1) are affected. The fix is available in Firefox 141 and ESR 140.1 and Thunderbird 141 and ESR 140.1.

The CVSS score of 8.1 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure a user to a malicious origin capable of performing DNS rebinding; thus the risk primarily concerns phishing or compromised DNS infrastructure scenarios.