This vulnerability arises from improper handling of cryptographic operations in the Storage: Quota Manager component. The misuse could allow an attacker to read or modify data protected by encryption, potentially exposing quota information. The vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Thunderbird 153.4, and Thunderbird 157. The public details do not specify an attack vector, so remote abuse possibility remains unclear. The CVSS score is 8.1 and the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The cryptographic misuse poses a confidentiality risk, but exact risk cannot be precisely measured without further exploitation evidence.

All releases of Firefox prior to ESR 153.4 and Firefox 157, and all releases of Thunderbird prior to Thunderbird 153.4 and Thunderbird 157. The vulnerability is fixed in those specific builds. Users on newer ESR or stable channels should verify the installed version meets or exceeds the fixed build. No specific sub‑versions are listed, so any build older than the mentioned releases may be vulnerable.

The EPSS score is <1%, indicating a very low but nonzero exploitation probability. The CVSS score of 8.1 classifies this vulnerability as high severity. The vulnerability is not listed in the CISA KEV catalog. The lack of known exploitation in the wild and the absence of exploitation details mean the risk level cannot be precisely quantified, but cryptographic misuse poses a notable confidentiality risk. The exact attack surface—whether local or remote—is not detailed in the public information.