The vulnerability is a form autofill spoofing flaw that permits malicious actors to supply forged autofill suggestions to the browser’s autocomplete mechanism, thereby potentially inserting incorrect data into user input fields. This flaw does not provide a pathway for code execution or privileged escalation, but it can undermine the integrity of form entries. The weakness is categorized as spoofing (CWE-290).

Affected systems are Mozilla Firefox versions older than 151 and Firefox ESR releases older than 140.11, as well as Mozilla Thunderbird versions older than 151 and Thunderbird ESR releases older than 140.11. Any installation employing the default autofill feature remains vulnerable until updated to the patched releases.

The CVSS score of 6.5 reflects moderate severity, while an EPSS score of <1% indicates a low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Attackers would likely need to lure a user to a malicious web page that triggers the autofill component in order to inject spoofed suggestions; therefore, the attack vector is inferred based on the component’s operation.