This vulnerability resides in Firefox’s Form Autofill component and permits an attacker to inject forged autofill suggestions. The flaw is a spoofing weakness that affects data integrity and user trust but does not provide an execution path for arbitrary code. The description does not explicitly state the attack vector; it is inferred that an attacker would need to lure a user to a malicious web page that triggers autofill behavior, potentially causing the user to accept incorrect values or credentials, which could lead to credential theft or fraudulent input on web forms.

The vulnerability affects Mozilla Firefox versions before 151 and Firefox ESR versions before 140.11. Any installation of those releases that utilizes the default autofill functionality is susceptible until an update is applied.

No EPSS score is publicly available and the flaw is not listed in CISA’s KEV catalog, indicating limited current exploitation. The risk for a typical user remains low to moderate, though the potential impact on the integrity of form inputs is significant. Attackers would need to lure a user to a malicious site that triggers the autofill behavior; no remote code execution or privilege escalation is offered by the flaw. The description does not provide explicit exploitability details, so the assessment relies on the lack of exploitation evidence and the inferred attack path.