An information disclosure vulnerability exists in the Form Autofill component of Mozilla Firefox. By exploiting this flaw, an attacker can read sensitive data entered into web forms, such as usernames, passwords, or personal details, that is normally protected from external view. The flaw is categorized as a type of information exposure (CWE-359) and can compromise confidentiality of user credentials and personal data.

Mozilla Firefox versions prior to 150 and the Firefox ESR release 140.10, and Mozilla Thunderbird versions prior to 150 and Thunderbird ESR 140.10, are affected. The issue was resolved in Firefox 150 and ESR 140.10, and in Thunderbird 150 and ESR 140.10, so any installation of earlier builds may be at risk. The vulnerability applies to all platforms where the Form Autofill feature is available, including Windows, macOS, Linux, and mobile variants.

The CVSS score is 5.3, and the EPSS score is unavailable, but the vulnerability is listed as not in the CISA KEV catalog. Because the exploit requires the ability to trigger form autofill for a target user, the attack vector is likely local or requires user interaction; a purely remote attack is not indicated. Nevertheless, the potential for leaking personal or authentication data makes the flaw significant, especially in environments where forms contain sensitive information.