A race condition in the Networking component can lead to the unintended disclosure of data. The vulnerability allows a malicious entity to read information that should be protected, potentially exposing sensitive state or configuration details. The flaw is inherent in the component’s handling of concurrent operations, which can be exploited if an attacker can influence timing or trigger specific network traffic sequences.

Mozilla Firefox versions older than 159 and Firefox ESR 153.6 are affected. The issue was addressed in updates 159 and ESR 153.6 respectively.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no current reports of exploitation. Without a public CVSS score, the exact severity cannot be quantified by metrics, but the nature of the flaw suggests a moderate risk to confidentiality if the race can be reliably triggered. It is inferred that the attack vector might be remote or local network traffic that manipulates timing, though the description does not state this explicitly.