The postMessage component in the DOM bypasses standard browser mitigations, enabling an attacker to send crafted messages that the application treats as trustworthy. This bypass can allow the execution of privileged actions within the page without user consent, potentially leading to unauthorized data access or transaction forging. The vulnerability is a Cross‑Site Request Forgery weakness (CWE‑352).

Mozilla Firefox and Mozilla Thunderbird are affected. All releases prior to version 150 contain the flaw, as it was fixed in both Firefox 150 and Thunderbird 150. No specific sub‑versions are listed, so any installation of Firefox or Thunderbird older than 150 should be considered at risk.

The CVSS score is 6.5, indicating moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the available data. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: a malicious web page or third‑party script can send a crafted postMessage to a vulnerable page, bypassing normal message‑origin checks and potentially triggering privileged operations. Successful exploitation would require the victim to have the vulnerable page loaded in their browser and for the attacker to control a source that can communicate via postMessage.