The vulnerability resides in the XML component of Mozilla Firefox and Thunderbird, allowing an attacker to read sensitive data that should not be accessible. It is a classic information‑disclosure weakness (CWE‑200) that can expose configuration files, credentials, or other private information embedded in XML documents. Adversaries could exploit this flaw to gather contextual data that supports further attacks.

All releases of Firefox and Thunderbird before version 147 are affected. The advisory applies to the Mozilla Firefox browser and the Mozilla Thunderbird email client.

The CVSS score of 5.3 classifies it as a moderate risk, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would likely require delivery of a crafted XML file to the target system; attackers could then read the disclosed information, potentially leading to further compromise. The lack of public exploits suggests that sandboxing or disabling the vulnerable XML parsing path could mitigate the risk if patching is not immediately possible.