This vulnerability is a site isolation issue within the Networking: HTTP component of Mozilla Firefox that can enable a malicious site to access data from another site without respect for the browser’s domain isolation boundaries, thereby compromising confidentiality.

Versions of Firefox prior to 159 and the ESR 153.6 build are affected. Users running legacy or unsupported builds of Firefox that have not applied the security fix should be considered vulnerable.

The CVE does not report a Remote Access or exploitation method, nor is it listed in CISA’s KEV catalog. No EPSS score is available, indicating the exploitation likelihood is unknown, but the inability to enforce site isolation could still be leveraged by attackers who trick users into visiting malicious content. The severity level is unquantified in the available data, suggesting that the impact is limited to possible data leakage rather than code execution.