The vulnerability allows a bypass of the same‑origin policy through the DevTools component. An attacker who can trigger the affected DevTools operation could read or modify data that should be protected by the policy. The potential impact includes data exfiltration, injection of malicious content, and unauthorized manipulation of cross‑origin information, which could threaten confidentiality, integrity, or both.

Mozilla Firefox and Thunderbird are affected. The fix is available in Firefox ESR 153.4, Firefox 157, Thunderbird 153.4, and Thunderbird 157. All earlier releases are potentially vulnerable as no lower bound is specified.

With a CVSS score of 8.1 the vulnerability is high severity, yet the EPSS score of less than 1% indicates a low exploitation probability. The CVE is not listed in the CISA KEV catalog, implying no known active exploits. The likely attack vector is local: a user or local script that can access DevTools may exploit the flaw. Because the policy bypass is confined to DevTools, broader system compromise requires additional conditions such as a compromised page or phishing, but the impact can still be significant if those conditions are met.