Frame poisoning is a vulnerability in the Layout component that can allow an attacker to inject malicious frames or alter the content of existing frames. This can lead to cross‑site scripting or clickjacking attacks, potentially compromising user data or causing unauthorized actions. The weakness originates from insufficient validation of frame content, aligning with common input validation flaws.

The affected product is Mozilla Firefox, specifically versions prior to Firefox ESR 115.44. The vulnerability was addressed in the ESR 115.44 release, so users running earlier ESR builds are impacted.

The CVSS score is not provided, but the EPSS score is unavailable, indicating that the probability of exploitation in the wild is currently unknown or low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver a malicious frame or crafted content to the vulnerable Layout process, so the attack vector requires user interaction or the presence of malicious web content.