The vulnerability is a spoofing issue in the DOM copy and paste and drag‑and‑drop components. It allows an attacker to cause a user to believe that data came from a trusted source when it did not—facilitating phishing, data manipulation, or social‑engineering attacks. The flaw arises from improper origin validation in the clipboard and drag event handling, corresponding to CWE‑290.

The issue affects Mozilla Firefox and Thunderbird. All versions prior to Firefox 147 and Firefox ESR 140.7, and Thunderbird 147 and Thunderbird ESR 140.7 are vulnerable. Subsequent releases are fixed.

The CVSS score of 5.4 indicates moderate severity while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the KEV catalog and no public exploit is known. The attack vector appears to be local and user‑interactive, requiring a user to copy or drag content from a malicious source such as a compromised website or email attachment; exploitation relies on user interaction in addition to the technical flaw.