The vulnerability lies in the CSS Parsing and Computation component of Mozilla Firefox and allows an attacker to inject malicious frame references into parsed CSS, enabling frame poisoning. This can lead to cross‑site scripting, phishing, or unauthorized data access on the victim’s machine. The weakness arises from improper input handling as reflected in CWE‑79 and CWE‑20.

Mozilla Firefox is the affected vendor. Versions released before 159 may contain the flaw, although the specific pre‑159 releases are not enumerated. Organizations using legacy installations should verify their version inventory.

No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating no publicly documented exploitation. The attack vector is browser‑based and requires a user to load a page containing malicious CSS. While the probability of large‑scale attacks is unclear, the potential impact of successful exploitation warrants prompt remediation.