The flaw resides in the networking subsystem of Mozilla’s Firefox and Thunderbird browsers, permitting an attacker to read data that should remain private. The weakness is identified as CWE‑200, or improper handling of information that an unauthorized party can access. The vulnerability could expose user credentials, URLs, or other sensitive network traffic, thereby compromising confidentiality.

Mozilla Firefox and Thunderbird users running versions earlier than Firefox 158, the ESR 153.5 line, Thunderbird 158, or the ESR 153.5 line are impacted. Updating to any newer release that includes the networking component fix resolves the issue.

The CVSS score of 4.3 denotes moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, indicating that the real‑world exploitation likelihood is uncertain. The attack vector is inferred to be remote, contingent on the user loading malicious web content or interacting with compromised network traffic, because the vulnerability stems from the networking component used during HTTP/HTTPS operations. Therefore, while exploitation probability appears low, the potential for confidential data disclosure warrants prompt remediation.