The vulnerability resides in Firefox’s Networking: HTTP component and allows a malicious actor to present a forged response or server identity to the browser. The flaw enables the attacker to masquerade as a legitimate server, potentially intercepting sensitive data or delivering malicious content without the user’s awareness. This type of spoofing directly compromises authentication integrity and can lead to man‑in‑the‑middle attacks or phishing through authentic‑appearing HTTPS connections.

Mozilla products, specifically Firefox, Firefox ESR, and Thunderbird, are affected. The issue is fixed in Firefox ESR 153.4 and Firefox 157, as well as in Thunderbird 153.4 and Thunderbird 157; any older build is vulnerable.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score indicates a very low exploitation probability of less than 1%. The vulnerability is not listed in the KEV catalog, implying no known public exploitation. Nevertheless, the flaw involves network traffic that could be abused by an attacker with network proximity or a compromised DNS entry. The likely attack vector is remote over HTTP/HTTPS, and the patch for both Firefox and Thunderbird resolves the issue.