This vulnerability allows an attacker to bypass the cookie mitigation checks implemented by the Networking: Cookies component, enabling the setting or reading of cookies that should otherwise be prohibited.

Mozilla Firefox and Mozilla Thunderbird installations using any version before 150 are vulnerable; the fix was introduced in Firefox 150 and Thunderbird 150.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests a low probability of exploitation. It is not listed in CISA KEV. Based on the description, it is inferred that exploitation requires malicious content that triggers the cookie handling logic, such as crafted HTTP requests or malicious web pages injected into the browser or email client.