The reported vulnerability is a spoofing flaw within the Web Speech component of Mozilla Firefox. An attacker could potentially pose as a trusted origin, causing the browser to accept or execute speech commands that the user believes are legitimate. This deception can allow an attacker to trick the user or manipulate the web page into performing unintended actions, resulting in confidentiality, integrity, or availability concerns. The nature of the weakness is related to improper access control or verification during the use of the Web Speech API.

Mozilla Firefox and Thunderbird versions prior to 151 are impacted. The flaw was fixed in Firefox 151 and Thunderbird 151, and the supplied data identifies both vendors as affected.

The CVSS score is 7.5, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a malicious web page that uses the Web Speech API to present or execute recognized speech content without correct origin validation. While there is no public evidence of exploitation, the absence of a check suggests the flaw could be leveraged by attackers with sufficient skill. Promptly applying the vendor patch is advised owing to the potential for deceptive or destructive behavior.