The vulnerability allows bypass of the browser’s Same-Origin Policy in the Networking: JAR component, enabling access to resources from other origins. This is an Access to Local Resource via Insecurely Configured Resource (CWE-346) failure that could allow attackers to steal or modify data cross‑origin. The defect was addressed in Firefox and Thunderbird version 151.

Mozilla Firefox and Thunderbird browsers released prior to version 151 are affected. No specific version list was provided, so all builds before the fix are considered at risk.

The EPSS score is not publicly available, and the CVSS score is 6.5. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote or local, using crafted JAR files that the browser processes. Successful exploitation would grant the attacker read or write access to data belonging to another origin, thereby compromising confidentiality and integrity.