The defect in the DevTools component lets the same-origin policy be bypassed, potentially permitting an attacker to access data that should be isolated by origin, such as cookies or locally stored values. This violation undermines the confidentiality guarantees that browsers provide between different web origins.

Mozilla Firefox and Thunderbird browsers released before version 158 are affected, as the flaw exists in all builds that include the DevTools component without the patch.

The CVSS score of 9.1 indicates a critical severity, while the EPSS score of less than 1 % suggests that exploitation opportunities are currently very limited. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require a user to have DevTools open and an attacker to inject malicious code into that context, but no public exploit is known. Based on the description, it is inferred that the attack vector involves a privileged user context, as it depends on the DevTools being active and the attacker’s ability to run code within it.