Uninitialized memory in Firefox and Firefox Focus for Android can lead to accidental exposure of private data such as browsing history, cookies, or stored credentials. The bug is classified as CWE‑908, Improper Memory Management, because the browser does not clear memory buffers before reuse, allowing an attacker to read residual data after a view or component is no longer in use. The vulnerability does not require code execution or elevated privileges, but it can compromise confidentiality of user information.

The flaw affects Mozilla Firefox on desktop and Firefox Focus on Android. All builds released prior to Firefox 148 contain the defect, as the fix was introduced in that version. Users of earlier releases are at risk until they upgrade.

With a CVSS score of 6.5, the vulnerability is considered moderate, primarily affecting the confidentiality of user data due to a CWE‑908, Improper Memory Management flaw. The EPSS score of less than 1% and absence from CISA’s KEV catalog suggest that exploitation of this flaw is unlikely in the wild. The attack vector is not explicitly detailed in the available data; based on the description, it is inferred that the leak may be triggered by local user interaction or a malicious web page that causes the browser to access uninitialized memory. This does not require code execution or elevated privileges, and the impact is limited to information disclosure.