The vulnerability is an information disclosure flaw within Mozilla’s Networking: JAR component, which can expose sensitive data. The flaw is aligned with CWE‑200 and can compromise confidentiality when exploited. The issue affects Firefox and Thunderbird releases prior to the security fixes available in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. An attack could involve presenting a malicious JAR file to the component, potentially leaking private information.

This flaw affects Mozilla Firefox and Thunderbird installations on all operating systems where the Networking: JAR component is enabled. The fixes are available in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. Systems running earlier releases of these branches are vulnerable.

The EPSS score is < 1%, indicating a very low likelihood of exploitation in current observed activity, and it is not listed in the CISA KEV catalog, indicating no known exploitation campaign. However, because the flaw allows information to escape over the network, the likely attack vector is indirect remote exploitation via user interaction with a malicious JAR resource. The CVSS score is 4.3, but the presence of a patch in multiple release lines and the lack of detection in KEV suggest the risk is moderate to high for systems that remain unpatched. Immediate attention is advised to upgrade or apply the fix.