Site isolation in the DOM: Web Authentication component fails to enforce strict boundaries between web content and the authentication subsystem. As a result, a malicious page can obtain authentication credentials or privileged tokens that belong to the user. This can lead to credential theft or unwanted privileged actions on behalf of the victim. The specific weakness is an Access Control flaw (CWE-862).

Mozilla Firefox and Mozilla Thunderbird are the only named products affected. The issue is fixed in Firefox 158 and Thunderbird 158, meaning that any release older than 158 is vulnerable. The vulnerability affects the Web Authentication API within the DOM layers of the browsers.

The CVSS score of 9.6 indicates a high severity. The EPSS score is below 1 % showing that at the time of analysis real‑world exploitation is unlikely. The vulnerability is not listed in CISA KEV, which also suggests limited evidence of exploits. The likely attack vector is remote: an attacker lures a user to a malicious website that exploits the Web Authentication component. Because the flaw involves insufficient isolation, the impact could be significant if exploitation succeeds, though evidence of active exploitation is currently missing.