The vulnerability involves improper enforcement of the CSP frame-src directive for URL paths, resulting in the browser ignoring path restrictions when validating frame navigations. An attacker can craft URLs that bypass these restrictions, allowing malicious content or scripts to be loaded within frames. This bypass undermines the intended security boundary of content‑security policies and can enable phishing, credential harvesting, or other forms of data tampering, effectively compromising the confidentiality and integrity of user data.

Mozilla Firefox 140 and earlier, Firefox ESR 139 and earlier, Mozilla Thunderbird 140 and earlier, and Thunderbird ESR 139 and earlier are affected. The issue is fixed in Firefox 141 and later or ESR 140.1 and later, and in Thunderbird 141 and later or ESR 140.1 and later.

With a CVSS score of 9.8 the vulnerability is high severity, indicating a substantial potential impact. The EPSS score of less than 1% suggests a relatively low probability of exploitation at this time, and the vulnerability is not currently listed in CISA’s KEV catalog. However, the bug can be triggered by a user opening a maliciously crafted page or email that includes a frame whose source path is protected by frame‑src but is incorrectly validated. Thus, the likely attack vector involves a user-initiated action such as browsing or email attachment viewing, and while it does not provide direct remote code execution, it can facilitate the injection or execution of hostile content within the browser context.