The vulnerability allows unintended exposure of sensitive information through the networking component of Firefox. The flaw permits an attacker to read data that should be protected, potentially revealing user credentials, local network information, or other private data. The underlying weakness can be classified as an information exposure flaw (CWE-200).

Affected products are Mozilla Firefox, with the issue present in versions prior to Firefox 158 and Firefox ESR 153.5. All earlier releases should be considered vulnerable until a patch is applied.

The CVSS score is 4.3, indicating a moderate impact, and the EPSS is unavailable, leaving the precise likelihood of exploitation unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploitation yet. Based on the description, the likely attack vector involves interaction with the networking stack via normal browsing activity. An attacker would need to trigger the exposed data path, which could be achieved through crafted network requests or local network configuration.