The vulnerability is a mitigation bypass in the Networking: HTTP component of Mozilla Firefox and Thunderbird. By exploiting a flaw in how HTTP traffic is processed, an attacker could circumvent security controls that rely on this component, potentially accessing protected resources or leaking data. The official details are sparse, but the patch notes indicate that Firefox version 158, ESR 153.5 and Thunderbird versions 158, ESR 153.5 contain the fix.

All Mozilla Firefox releases older than version 158 and the ESR branch versions earlier than 153.5, as well as Thunderbird releases older than 158 and ESR 153.5, are affected. Users running these browsers remain vulnerable until they upgrade to a patched release.

The EPSS score is <1% (0.00166), indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.1 indicates a high severity, quantifying the risk to confidentiality, integrity, or availability. Attackers would likely need to send crafted HTTP requests to the victim’s browser session over the network. Given the absence of widely known exploits, the immediate risk is hard to gauge, but the potential consequences of a successful bypass could be severe if confidential data or sensitive credentials are exposed.