The vulnerability allows an attacker to bypass DOM‑level mitigation controls in the Push Subscriptions component of Firefox. A site or script can register push subscriptions without the user’s explicit consent, potentially leading to unauthorized notifications and the injection of malicious content. The weakness involves improper access control within the browser’s push API.

All Mozilla Firefox releases prior to version 159 and the ESR line before 153.6 are impacted. The fix was introduced in Firefox 159 and Firefox ESR 153.6, so any system still running an earlier build needs updating.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Despite that, because it can be triggered by a malicious web page that a user visits, the risk level can be considered moderate. Attackers would need only a legitimate or compromised site to deliver the harmful payload, making it a low‑effort, high‑impact vector for users whose browsers remain unpatched.