The flaw lies in Firefox’s DOM Core & HTML component and permits a malicious web page to present interface elements that appear to originate from a different origin, misleading the user about the true source of the content. The weakness can be classified as a spoofing vulnerability that involves incorrect origin identification and potential information exposure, aligning with CWE-639 and CWE-200.

Mozilla Firefox users running any version earlier than 155, or the ESR 153.2 build, are affected. This includes all operating systems that deploy these legacy releases at the time of use.

No CVSS score is reported, and the EPSS score is unavailable, making precise severity assessment difficult. The vulnerability is not listed in CISA’s KEV catalog, implying that large‑scale exploitation has not yet been observed. The suspected attack vector is a standard web browsing scenario, where a user visits a malicious site containing the malformed DOM content; no additional software or privileged state is required. Overall risk depends on how many users remain on the vulnerable browser versions and the likelihood they encounter such sites.