This vulnerability allows an attacker to forge the identity of a serial device in the browser’s Document Object Model through the Web Serial component. By maliciously manipulating the API, a user can be led to interact with a device that appears legitimate, allowing a malicious site to present a different serial device to the user. The weakness is a form of improper validation, permitting unauthorized masquerading of device identity. The impact therefore compromises authenticity of the device presented to the user.

Mozilla Firefox users running any release earlier than 158 or earlier ESR 153.5 are vulnerable, as are Mozilla Thunderbird users on releases earlier than 158 or earlier ESR 153.5. Any instance of these browsers that exposes the Web Serial API without the patch could be exploited. Updating to the listed fixed releases removes the flaw from both browsers.

The publicly disclosed EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS base score is 6.1. Based on the description, the likely attack vector is a user visiting a malicious web page that requests access to the Web Serial API; the attacker must encourage the user to grant permission, usually via phishing or social‑engineering. This implies a low technical barrier but a moderate to high social‑engineering effort. No publicly known exploits exist at this time, but the potential for abuse remains if a malicious site can convince a user to allow device access.