When a user explicitly decrypts an inline OpenPGP message that is embedded within an HTML‑styled email, the decrypted content is rendered inside the same CSS context as the outer message. An attacker can craft CSS rules, custom fonts, and animations that expose the hidden plaintext or coerce the client to transmit it to a remote endpoint, enabling the confidential contents of the email to be exfiltrated. This flaw results in an information‑disclosure vulnerability.

All versions of Mozilla Thunderbird before 147.0.1 and, for the ESR channel, before 140.7.1 are affected. The issue is present in builds that support OpenPGP decryption and HTML email rendering and is resolved in the referenced release numbers.

The exploit requires the user to both decrypt the message and have the remote content option enabled, making it a user‑interaction attack. The CVSS score of 4.3 reflects its moderate severity given these prerequisites. End users are unlikely to encounter widespread exploitation, and the EPSS score of less than 1% indicates a low likelihood of attack. The flaw is not listed in the KEV catalog, suggesting it has not yet been actively exploited at scale. Nevertheless, the vulnerability should be mitigated promptly to prevent potential information leaks.