The IP Protection component in Mozilla Firefox and Thunderbird allows a flaw that can expose private data, identified as a CWE-200 weakness. This vulnerability can reveal proprietary or confidential content if an attacker can read information that the component is meant to protect. The CVSS score of 7.5 reflects the high severity that could arise from such exposure.

Firefox and Thunderbird versions older than 151 contain the flaw; version 151 and newer of each product are not vulnerable. No other vendors or products are indicated in the advisory.

The EPSS score of less than 1% and absence from the CISA KEV catalog suggest a low probability of widespread exploitation. Based on the description, it is inferred that the attack vector likely requires interaction with the vulnerable code path, such as through crafted content or a local user action, rather than an automated remote exploit. As a result, any user or attacker who can trigger the IP Protection logic on an affected installation could access exposed data, maintaining a confidentiality risk until the fix is applied.