The updated vulnerability description indicates a mitigation bypass in the Networking: Cookies component of Firefox and Thunderbird. This flaw allows certain cookies that normally would be restricted to be accepted or set, potentially undermining cookie policy enforcement. The weakness is categorized as CWE-288 and CWE-807.

Mozilla Firefox clients running any version prior to 150 and Thunderbird clients running any version prior to 150 are affected. The issue was fixed inFirefox 150, so any releases older than that must be upgraded to eliminate the flaw.

The CVSS score is 9.8 and the EPSS score is not available, indicating critical severity but unknown exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been exploited publicly. Based on the description, the likely attack vector is through a web page rendered in a vulnerable Firefox or Thunderbird client, which would require a user to visit a malicious site. The risk is high, as the flaw permits cookie manipulation that could impact session integrity, but exploitation would rely on the user’s browser and may not be globally available.