Firefox and Thunderbird contain a flaw that can bypass built‑in DOM security checks. The effect is that a malicious script could run in the browser context. Based on the description, it is inferred that this could enable theft of user data, credential compromise, or further malicious activity, although the official CVE text does not explicitly state these outcomes. The vulnerability was fixed in Firefox 147, Firefox ESR 115.32, 140.7, Thunderbird 147, and Thunderbird 140.7.

All Mozilla Firefox releases below version 147, all ESR builds before 115.32 and 140.7, and all Mozilla Thunderbird releases below version 147 or ESR builds below 140.7 are vulnerable. Versions 147 and later, ESR 115.32 or 140.7 and later are secure.

The CVSS score is 8.1, indicating high severity, while the EPSS score is <1%, showing a very low exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a malicious web page or email containing crafted content that targets the DOM security component; exploitation would require user interaction such as visiting the page or opening the message.