The vulnerability involves a flaw in the browser’s DOM Core and HTML component that allows a malicious web page to present interface elements that appear to originate from a different origin. This can mislead users into believing content comes from a trusted source, exposing information and violating correct origin identification.

Mozilla Firefox and Thunderbird users running any version earlier than 155, or the ESR 153.2 build, are affected. This includes all operating systems that deploy these legacy releases at the time of use.

The CVSS score is 9.8, and the EPSS score is < 1%, indicating a very high exploitation risk, though the low EPSS suggests limited real-world exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying that large‑scale exploitation has not yet been observed. The suspected attack vector is a standard web browsing scenario, where a user visits a malicious site containing the malformed DOM content; no additional software or privileged state is required. Overall risk depends on how many users remain on the vulnerable browser versions and the likelihood they encounter such sites.