The vulnerability stems from a flaw in Firefox’s CSS parsing and computation component that allows a malicious website to bypass the same-origin policy. Based on the description, it is inferred that an attacker may read or modify resources that should be protected by cross-origin restrictions, potentially compromising the confidentiality or integrity of user data. The weakness is classified as CWE‑346, indicating an access control violation inherent in the browser’s handling of CSS.

Mozilla Firefox versions earlier than 148.0.2 are affected. All builds of Firefox that match the Mozilla:Firefox product entry are vulnerable until the 148.0.2 release applies the fix.

The CVSS base score of 6.5 denotes a moderate risk level. The EPSS score of less than 1% indicates that, as of now, the probability of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a web page that a user visits, delivering specially crafted CSS that triggers the bypass. Successful exploitation would occur entirely in the victim’s browser without any additional user interaction beyond normal browsing.