A vulnerability in the Graphics component allows an attacker to read sensitive information that should not be exposed. The flaw can lead to the disclosure of potentially confidential data, compromising confidentiality for affected users. The weakness is a failure to properly restrict access to internal data structures used by the graphics subsystem, which can be triggered by crafted content or during normal rendering operations.

Mozilla Firefox is impacted, with the issue fixed in Firefox 154, Firefox ESR 115.39, 140.14, and 153.1. Any installation of older Firefox releases is susceptible to the disclosure. System administrators should verify that their deployments have migrated to one of the fixed release or ESR branches.

The CVSS score is not provided; however, the vulnerability is listed as an information disclosure and is not included in the CISA KEV catalog, which suggests a lower publicly known exploit risk. The EPSS score is unavailable, so the likelihood of exploitation remains uncertain. Nonetheless, the attack vector is not defined in the description; based on the affected component it is reasonably inferred that the vulnerability can be triggered through local or remote content that exercises the graphics subsystem. Due to the absence of a reported exploit, the immediate risk is moderate but mitigable by updating the browser.