This vulnerability allows an attacker to trigger a denial-of-service condition in the Site Reports component of Mozilla Firefox and Thunderbird. The attacker can cause the browser or email client to consume excessive resources or become unresponsive, leading to a loss of availability for the user. The weakness appears to be a flaw in how the component processes certain input, enabling resource exhaustion or an infinite processing loop. Based on the description, it is inferred that the component processes untrusted data without proper validation, leading to unauthenticated denial-of-service. The CVE description does not indicate a compromise of confidentiality or integrity, but the impact is a denial of the ability to use the affected application normally.

Mozilla Firefox and Thunderbird versions prior to 158 are affected. The vulnerability is fixed in versions 158 and above for both browsers. No additional product or version details are supplied.

No EPSS score is available, and the vulnerability is not listed in the KEV catalog. The CVSS score of 6.5 indicates a moderate severity. However, the vulnerability is a denial-of-service flaw that can be exploited remotely if the attacker can influence the processing of Site Reports data, such as by sending crafted URLs or content to the affected browser or Thunderbird. The likely attack vector is through the internet, because the Site Reports component is reachable via web pages or URLs. The absence of publicly reported exploits suggests that active exploitation may not yet be observed, but the component remains exposed to the internet and therefore remains a potential target.