The vulnerability is a spoofing issue in the Popup Blocker component of Mozilla Firefox and Thunderbird. Based on its description, it is inferred that a malicious popup could be presented as originating from a trusted or familiar source, potentially leading users to disclose sensitive information or engage with malicious content. This weakness corresponds to CWE‑451.

Any installation of Mozilla Firefox or Thunderbird older than version 151 is affected. The vulnerability applies regardless of operating system, as it resides entirely within the browser client and does not require elevated privileges or special network services.

The CVSS score of 7.5 indicates a moderate-to-high impact, reflecting the potential for significant user deception. The EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, so the exploitation probability is unknown but could exist in the wild in typical use scenarios. Based on the description, it is inferred that the likely attack vector involves an active adversary that can host or craft a malicious webpage or phishing link; the user must inadvertently load that page in their browser for the spoofed popup to appear.