The vulnerability affects Mozilla Firefox’s networking layer by failing to enforce proper site isolation, potentially allowing a malicious site to access content or resources from another site that it should not be able to reach. If exploited, an attacker could read or manipulate data belonging to a different user or origin, compromising confidentiality and the integrity of user data in the browser. The description indicates the flaw was identified and fixed in Firefox 158 and Firefox ESR 153.5, implying that earlier releases lack the necessary isolation controls.

All Mozilla Firefox installations running versions earlier than 158, and for the ESR line, all releases older than 153.5, are affected. This includes standard Firefox as well as the extended support release channel. Additionally, all Mozilla Thunderbird installations running versions earlier than 158, and for the ESR line, all releases older than 153.5, are affected. Systems running newer releases are not impacted.

Because the EPSS score is < 1%, indicating a very low probability of exploitation, and the issue is not listed in CISA KEV, the likelihood of exploitation appears low. The CVSS score is 8.1, indicating high severity, which informs the assessment of risk. The likely attack vector, inferred from the nature of a site isolation defect, is a web‑based approach that requires access to a browser‑controlled context, possibly through a user visiting a malicious or compromised site. No workaround or workaround effectiveness is reported, so controlling traffic or upgrading remains the primary mitigation strategy.