This vulnerability allows an attacker to read potentially sensitive data handled by the Networking component of Mozilla’s desktop applications. The flaw permits unauthorized disclosure of information that the application processes, which could include user credentials, session identifiers, or other private data transmitted over the network. The weakness is catalogued as CWE-200, indicating that exposed data can be accessed by an unauthenticated user.

The flaw impacts Mozilla’s Firefox and Thunderbird clients, including both standard and Extended Support Release versions. Versions up to and excluding Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7 are affected. Users running older releases of these browsers or email clients are therefore at risk.

The CVSS score of 5.3 places this flaw in the moderate range of severity, but the EPSS score of less than 1% suggests that exploitation is unlikely. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers could exploit the vulnerability through network-based means, such as sending crafted packets or manipulating the data flow within the client, though no specific exploit has been publicly documented. The primary protection is to prevent unauthorized access to the application’s networking module, which the vendor mitigates through the patched releases.