The vulnerability is a same‑origin policy bypass in the Graphics: ImageLib component of Mozilla Firefox. It allows a malicious web page to read image data from sources that should be protected by the browser’s isolation rules, thereby leaking information that could reveal sensitive data or internal resources. The flaw is a direct violation of the browser’s same‑origin policy, effectively granting cross‑origin access that is normally disallowed.

The flaw was fixed in Firefox releases 154, ESR 115.39, ESR 140.14, and ESR 153.1, and in Thunderbird releases 154, 140.14, and 153.1. All Firefox and Thunderbird versions older than those release numbers, including current releases prior to update, are affected. The affected vendors include Mozilla’s Firefox web browser and Thunderbird email client.

The CVSS score is 5.4 and EPSS data are not available, indicating a medium severity; the precise exploitation probability cannot be quantified. However, the vulnerability grants high‑impact cross‑origin access and could be leveraged by an attacker who can trick a user into visiting a malicious webpage. No exploitation in the wild is reported and the flaw is not listed in CISA’s KEV catalog, but the risk remains high for systems exposed to untrusted web content until a patch is applied.