Same-origin policy bypass in the CSS Parsing and Computation component can allow an attacker to circumvent the browser's same-origin restrictions, enabling access to data that should only be available within its own origin. The vulnerability is triggered through CSS parsing, which can lead to unintended data exposure across browser contexts, potentially compromising user privacy and application integrity.

Mozilla Firefox users running versions prior to Firefox 159, Firefox ESR 115.44, or Firefox ESR 153.6 are affected. All earlier releases that were not patched by these updates remain vulnerable.

The lack of an EPSS score and its absence from the CISA KEV catalog suggests that active exploitation is not currently documented, though the severity of a same-origin policy breach is high. An attacker would need to host malicious web content that references CSS causing the parsing flaw, typically via a compromised or malicious website. Once triggered, the flaw grants the browser unauthorized access to cross-origin resources and could allow further attack steps such as data theft or session hijacking. The vulnerability can be exploited remotely and does not require privileged local access.