The vulnerability is a DOM: Core & HTML component spoofing flaw that allows a malicious web page to forge or misrepresent DOM elements, potentially leading to user confusion, phishing, or credential theft. It manifests in both Mozilla Firefox and Thunderbird browsers. The flaw does not provide direct code execution but can damage the integrity of the user interface. It is aligned with input validation and user interface integrity weaknesses.

Mozilla Firefox versions before 150 and Mozilla Thunderbird versions before 150 are vulnerable. Firefox ESR 115.35, Firefox ESR 140.10, and Thunderbird ESR 140.10 contain the fix and are not affected. Systems running those versions are safe.

No EPSS score is listed, and the vulnerability is not indexed in the CISA KEV catalog, indicating no known exploitation yet. The likely attack vector involves a maliciously crafted web page that the user visits, as the flaw resides in the browser’s core DOM handling. The risk for a typical organization is moderate: an attacker could deceive users but requires user interaction. Nonetheless, the lack of a public exploit reduces but does not eliminate the risk, so patching is advised.