Setting a cookie without a name but with a value that contains an equals sign causes that cookie to override (shadow) any existing cookie with the same name, even if the existing cookie is marked Secure and sent only over HTTPS. The flaw allows a malicious actor to overwrite or manipulate secure authentication cookies, potentially enabling session hijack or authentication bypass. The vulnerability is classified as CWE‑614, denoting improper handling of cookie data.

Mozilla Firefox up to version 140 and any earlier ESR releases prior to 140.1, as well as Thunderbird up to version 140 and ESR releases before 140.1, are affected. Versions 141 (Firefox and Thunderbird) and ESR 140.1 provide the fix.

The CVSS score of 9.1 indicates a critical severity, while the EPSS score of less than 1% suggests that exploitation in the wild is currently low and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw by injecting a nameless cookie with an equals sign into a target domain’s cookie store via a malicious site or script, thereby masking a secure session cookie and hijacking the session. The attack requires only the ability to set a cookie for the target domain, which can be achieved through normal web browsing or malicious web content.