The CVE description labels this as an issue in the DOM’s File component but does not explicitly confirm arbitrary JavaScript execution. It indicates that prior to the specified patch releases the flaw existed, though the precise sub-process by which user interaction might trigger exploitation is not detailed. Therefore the exact impact on confidentiality, integrity, or availability remains undefined in the official record.

The issue affects all builds of Firefox up to version 158 and the Firefox ESR 153.5 line, as well as Thunderbird up to version 158 and Thunderbird ESR 153.5. Versions newer than these include the fix.

The CVSS score of 8.1 indicates a high severity flaw, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the description does not confirm an execution vector, the potential risk is inferred to be moderate, contingent on user interaction with possibly malicious content. As such, the threat remains primarily theoretical pending further details.