This flaw, identified as CWE‑346, allows an attacker to bypass the same‑origin policy in the Networking: JAR component, enabling the execution of code or access to data that would normally be restricted to a different origin. The vulnerability could let an attacker deliver malicious JAR files or read sensitive information from trusted origins, potentially compromising confidentiality, integrity, and availability of the affected system.

Mozilla’s Firefox and Thunderbird browsers are affected. All pre‑patched releases, including standard Firefox, Firefox ESR 140.8, Thunderbird, and Thunderbird ESR 140.8, remain vulnerable until updated to Firefox 148 or later and Thunderbird 148 or later.

The CVSS score of 8.8 marks it as a high‑severity issue. The EPSS score of less than 1% indicates a low but non‑zero probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Although the exact attack vector is not detailed in the advisory, the nature of the flaw suggests it can be triggered by a malicious web page or by locally crafted content that exploits the JAR component to read or execute content across origins.