This vulnerability arises from incorrect boundary checks within the Device Interfaces component of Firefox’s DOM implementation. The flaw can lead to memory corruption when an attacker provides crafted data that manipulates device interfaces. While the CVE description does not explicitly state the exploitation outcome, such memory corruption could, in principle, result in loss of confidentiality, integrity, or availability.

Mozilla Firefox and Thunderbird versions earlier than 150, as well as the ESR 140.10 line, are affected. Users should verify that their installations are not older than these patched releases.

The CVSS score of 6.5 indicates a medium severity, but the EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The lack of a published EPSS value means the risk cannot be precisely measured; however the documented memory corruption potential and medium severity suggest a noteworthy concern. The attack vector is likely local or remote via crafted DOM manipulation, although the exact method is not detailed in the vendor advisory.