The revised description confirms that the networking component can expose sensitive information to an attacker. This vulnerability allows unintended reading of data that should be protected, potentially revealing user credentials, internal network details, or other private data. The weakness is identified as CWE-200, an information exposure flaw.

Affected products are Mozilla Firefox and Thunderbird, with the issue present in versions prior to Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. All earlier releases should be considered vulnerable until a patch is applied.

The CVSS score is 4.3, indicating a moderate impact, and the EPSS score is not available, leaving the precise likelihood of exploitation unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploitation yet. Based on the description, the likely attack vector involves interaction with the networking stack via normal browsing activity. An attacker would need to trigger the exposed data path, which could be achieved through crafted network requests or local network configuration.