The WebExtensions component in Mozilla products contains a flaw that bypasses the same‑origin policy, allowing a malicious extension to read or modify web content from origins that should be isolated. This can lead to sensitive data exposure or the injection of unauthorized content, thereby compromising confidentiality and integrity of user data. The weakness is listed as CWE‑346, an improper restriction of operations within a component.

Mozilla Firefox and Mozilla Thunderbird are affected. All releases prior to Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17 and Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157 are vulnerable. Users running any older or equivalent builds without these specific patch releases must upgrade to a newer controller or the listed patched versions.

The CVSS score of 8.1 indicates high severity, while the EPSS score of < 1% shows that exploit attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local and requires a malicious or compromised browser extension that can trick the WebExtensions component into granting cross‑origin access. If an attacker can achieve this, they could read or modify sensitive data and potentially combine the attack with other weaknesses to increase its impact.