The vulnerability is a same-origin policy bypass in the Networking: HTTP component of Mozilla browsers. It allows a malicious web page or extension to read or manipulate resources belonging to other origins, thereby undermining the web browser’s fundamental security model. This flaw is a defect that could enable attackers to exfiltrate sensitive data or facilitate downstream attacks such as phishing or credential theft.

Affected are Mozilla Firefox browsers and Thunderbird clients. The defect was present in all releases before Firefox version 151 and Firefox ESR 140.11, and before Thunderbird version 151 and Thunderbird ESR 140.11. Users running older versions remain vulnerable until they upgrade to the patched releases.

Since the defect resides in the client‑side HTTP handling code, the likely attack vector is a malicious web page that forces the browser to issue cross‑origin requests, potentially reading data from other origins. With a CVSS score of 9.3, the vulnerability is rated as very high severity. No EPSS data or KEV listing is available, indicating that exploitation has not yet been reported in the public domain, but the breach of same‑origin policy is a severe security weakness. The risk remains high for any machine running a vulnerable version, and timely patching is strongly recommended.