The vulnerability is a side‑channel information disclosure in the Storage: Cache API component of Mozilla Firefox. An attacker can leverage this flaw to gain unintended access to private data held in the cache, such as HTTP response headers or sensitive cookies, thereby compromising confidentiality. The weakness is rooted in improper isolation of cached data across origins, facilitating covert data leakage.

The issue affects versions of Mozilla Firefox that were released prior to the bug fix, specifically browsers updated before Firefox 154 and before Firefox ESR 153.1. Any installation of those earlier releases that includes the Storage: Cache API component is susceptible. The problem is not present in Firefox 154 and later, nor in ESR 153.1 and newer.

The EPSS score is unavailable, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed exploit activity to date. Nonetheless, because the flaw relies on a side‑channel in browser storage that can be triggered by crafted web content, the attack vector is likely local within the user’s browser session. An attacker who can deliver malicious scripts to a user’s browser—such as through a compromised website or phishing—could exploit the vulnerability without needing elevated privileges, leading to potential confidentiality loss. The risk is elevated in environments where users access sensitive information through the Storage: Cache API.