A flaw in the Widget: Cocoa component permits sensitive data to be exposed to unprivileged parties. The weakness allows an attacker to read data that should remain confidential, potentially revealing personal or system information. The core weakness is classified as information exposure due to unprotected data handling.

Mozilla products Firefox and Thunderbird are affected. Versions up to and including Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9 contain the vulnerability. All newer releases have the fix applied.

The CVSS score of 7.5 labels this issue as high severity, while the EPSS score of less than 1% indicates that it is rarely exploited in the wild. It is not listed in the CISA KEV catalog. Attack vector is not explicitly documented, but based on the component involved, it is inferred that a malicious web page or a compromised local application could trigger the disclosure. Attacking conditions appear minimal and do not require specialized prerequisites.