Based on the description, it is inferred that a flaw in the Panning and Zooming component of Firefox and Thunderbird allows a web page to bypass the browsers’ site isolation protections, potentially exposing data or code belonging to other web origins. This weakness can lead to unintended data leakage or cross‑origin instrumentation, but it does not grant direct code execution. The underlying deficiency is a failure to maintain proper isolation boundaries within the rendering engine.

Based on the description, it is inferred that Mozilla Firefox and Thunderbird users running versions prior to Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, or Thunderbird 157 are vulnerable. The issue is fixed in those releases and later versions; updating to any of those builds removes the flaw.

The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.7 indicates moderate severity. No active exploits have been reported, but a malicious site could trigger the bug by manipulating page panning or zooming to exploit the bypass of site isolation. Based on the description, it is inferred that given the potential for sensitive data exposure and the lack of readily known mitigations, the vulnerability should be treated as high risk until a confirmed patch or workaround is deployed.