The vulnerability is described as an issue in the Address Bar component of Firefox and Thunderbird. It is categorized as CWE-451, a weakness that involves suppression of browser security features, potentially enabling deceptive navigation or misuse of trusted UI. No specific details are provided regarding the exploitation method or the potential consequences for confidentiality, integrity, or availability. The fix was introduced in release 158, but the cross‑product description does not clarify whether the flaw could be leveraged for navigation hijacking, phishing, or other attacks.

Mozilla Firefox and Thunderbird prior to version 158 are potentially affected. All releases that have not yet applied the patch that introduces the Address Bar fix are at risk.

The CVSS score of 7.3 indicates a high severity, while the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploitation. Because the description does not reveal a clear attack vector, the likelihood of exploitation appears low. However, if an attacker can manipulate the address bar or trigger its component from a malicious web page, the risk could increase, so applying the patch remains the safest mitigation.