The PDF Viewer component in Firefox and Thunderbird contains a clickjacking vulnerability that lets a malicious site cause the user to unintentionally interact with a PDF document, potentially revealing sensitive information. The flaw was addressed by correcting how the viewer handles user interactions, preventing the unintended disclosure. The weakness aligns with CWE‑497, where the component fails to restrict operations within the user's privilege bounds.

Firefox versions earlier than 147 and Firefox ESR versions earlier than 140.7, and Thunderbird versions earlier than 147 and Thunderbird ESR versions earlier than 140.7 are subject to the flaw. Mozilla products listed as affected include both Firefox and Thunderbird, encompassing their standard and extended support releases.

The vulnerability scores a CVSS of 4.3, a low to moderate severity level, and an EPSS score of less than 1%, indicating a very low likelihood of exploitation. It is not currently catalogued in CISA’s KEV. Attackers would need to host a malicious web page that embeds a PDF and induce the victim to click on the document area, exploiting the clickjacking flaw to expose document contents. No remote code execution or privilege escalation has been documented.