The flaw exists in the Form Autofill component of Mozilla Firefox and Thunderbird, allowing the application to reveal sensitive data that should remain private. The vulnerability is identified as an information exposure flaw (CWE-359). If exploited, an attacker could gain access to stored autofill entries such as usernames, passwords, or other personal data, compromising user confidentiality.

Versions of Mozilla Firefox and Thunderbird older than 154, as well as the ESR releases below 153.1, contain the defect. Upgrading to Firefox 154 or later, or to Firefox ESR 153.1 and newer, eliminates the weakness. The same applies to Thunderbird: patching to 154 or newer and to Thunderbird ESR 153.1 cures the issue.

The CVSS score of 7.5 reflects a high severity for information disclosure. The EPSS score of less than 1% indicates that exploitation is unlikely in the wild. The vulnerability is not included in the CISA KEV catalog, and based on the information publicized it is inferred that local privilege or the ability to run a script in the user context is sufficient to trigger form autofill and extract stored data. Consequently, the risk is primarily to confidentiality, with a low probability of exploitation.