The weakness lies in the storage subsystem of Mozilla’s IndexedDB engine. The advisory states that the issue has been fixed in Firefox 150 and ESR 140.10, as well as Thunderbird 150 and ESR 140.10. Although the precise failure mode is not described in the advisory text, the vulnerability is identified as CWE‑200 and CWE‑440, which indicate potential for information disclosure and improper restriction of operations within bounds.

Mozilla products Firefox and Thunderbird may be affected. The flaw exists in all builds older than Firefox 150 and Firefox ESR 140.10, as well as Thunderbird 150 and Thunderbird ESR 140.10. Users running any earlier version are potentially exposed to the vulnerability. The flaw is classified as CWE‑200 and CWE‑440.

The CVSS score is 6.5, EPSS is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. As CWE‑200 and CWE‑440, the flaw could allow an attacker to access confidential data stored in IndexedDB. Exploitation would require that the attacker target a system running an affected version; no additional prerequisites beyond the presence of the susceptible version are disclosed in the advisory.