The reported vulnerability is an improper access control flaw in the DOM navigation component of Mozilla's web browsers. Attackers can craft a navigation request that bypasses the site isolation boundary, allowing them to read or modify data belonging to a different origin that should be isolated. This can lead to the compromise of confidential information, cross‑origin data leakage, and unauthorized view or manipulation of private site resources. The weakness is represented by CWE‑346, Improper Access Control.

Mozilla Firefox versions prior to 155 in the main line and the ESR release before 153.2 contain the vulnerable navigation component. The same applies to Mozilla Thunderbird: all releases earlier than 155 and ESR versions older than 153.2 are affected.

The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. It has a high severity CVSS score of 9.8 but a very low EPSS score of < 1%, indicating a low probability of widespread exploitation at this time. The likely attack vector involves a crafted navigation request or link that a victim interacts with, such as visiting a malicious web page or opening a spear‑phishing email attachment. Based on the description, it is inferred that the attacker must deliver such a crafted navigation request, then observe the victim’s browser executing it and siphoning off cross‑origin data from the isolated site. Because exploitation requires user interaction with malicious content, the probability is moderate, but the potential for data leakage makes it high priority for remediation.