The flaw is a DOM: Core & HTML component spoofing vulnerability that allows a malicious web page to forge or misrepresent DOM elements. The resulting distortion of the user interface can enable phishing or credential theft, but it does not provide code execution or direct system compromise. The weakness involves insecure handling of UI elements, reflected in CWE‑1021 and CWE‑290.

Mozilla Firefox versions earlier than 150, including all standard releases and ESR branches prior to ESR 115.35 and ESR 140.10, are affected. Mozilla Thunderbird versions earlier than 150, and all ESR releases earlier than ESR 140.10, are vulnerable. The listed patch levels (Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, Thunderbird ESR 140.10) contain the fix.

The CVSS score of 6.3 indicates moderate severity. The EPSS score falls below 1 %, showing a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no known exploits. The likely attack vector is a malicious or compromised website that a user visits; the attacker would exploit browser core DOM handling to impersonate trusted UI elements. User interaction is required, but the potential for user confusion and credential leakage warrants prompt remediation.