The vulnerability resides in Firefox’s Networking: DNS component, permitting unintended exposure of sensitive information such as DNS request/response data or internal configuration details. The weakness is classed as an information exposure flaw (CWE-200), thereby compromising the confidentiality of data processed by the DNS subsystem.

Mozilla Firefox versions prior to 159, and the Firefox Extended Support Release version 153.6, are affected. Any installation that has not applied the update that fixed the flaw remains vulnerable.

No CVSS score or EPSS rating is available, and the issue is not in the CISA KEV catalogue, so the exact severity and likelihood remain undetermined. Although the comments do not spell out specific preconditions, the bug could be triggered by an attacker who can reach the DNS component—either locally or via network traffic. Until patched, the flaw should be regarded as a confidentiality risk.