A flaw in the Privacy: Anti-Tracking component can allow an attacker to present false information or bypass authentication checks, leading to spoofing of data that the browser or email client relies upon for privacy enforcement. The weakness stems from improper authentication controls, as classified by CWE-290. When triggered, an attacker could cause the client to treat untrusted input as legitimate, potentially undermining privacy protections and exposing user data to unintended parties.

Mozilla Firefox and Mozilla Thunderbird are affected, with all releases prior to version 149 susceptible. Users running older builds of either product are at risk until they upgrade to a fixed version.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. The attack vector remains inferred from the component involved; it is likely exploitable via crafted web content or email content when the Anti-Tracking feature is enabled.