The vulnerability allows a malicious website to bypass Firefox’s same‑origin policy in the navigation component of the DOM, enabling an attacker to read or manipulate content that is intended to be protected by the origin boundary. This protection mechanism failure can expose sensitive user data, such as personal information or session credentials, and could be leveraged for further attacks like phishing or credential theft.

Mozilla Firefox is affected. The flaw exists in all releases prior to Firefox 159 and the ESR 153.6 branch. Versions released after those milestones contain the fix.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no publicly documented exploits exist at this time. However, the lack of an EPSS score does not eliminate risk; attackers could trigger the flaw by presenting a crafted web page, so the confidentiality of user data remains at serious risk for any unpatched installation. Severity metrics such as CVSS are not reported in the advisory, but the nature of the flaw suggests a high likelihood of compromise if exploited.