This vulnerability in the DOM Push Subscriptions component of Mozilla Firefox and Thunderbird breaks site isolation boundaries, enabling a malicious website to access push subscription data that normally belongs to a different origin. This can expose subscription identifiers and possibly other user data, thereby compromising confidentiality. The description does not explicitly state the precise mechanics, but it is inferred that the issue permits a malicious website to read subscription data across origins.

The issue affects Mozilla Firefox and Thunderbird versions earlier than 155 and the ESR 153.2 branch. Users should upgrade to Firefox 155 or any newer ESR release that includes the fix, or to Thunderbird 155 or any newer ESR release that includes the fix.

The CVSS score is 9.8, indicating critical severity, while the EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability remains unlisted in the CISA KEV catalog. It still affects a widely deployed feature and can be triggered via a malicious website. The high CVSS indicates a serious confidentiality impact that can be exploited remotely by presenting crafted web content to the victim's browser. The attack vector is not explicitly described, but it is inferred that a malicious website could trigger the vulnerability.