The flaw allows an attacker to bypass the browser’s built‑in DOM protections for copy‑and‑paste and drag‑and‑drop operations. This can enable malicious content that would normally be blocked to be injected into the document object model of a web page or application. The vulnerability does not claim to provide arbitrary code execution; its primary consequence is the allowance of otherwise filtered content to reach the DOM.

The vulnerability affects all Mozilla Firefox releases prior to version 156, including ESR 140.16 and ESR 153.3, and all Mozilla Thunderbird releases prior to version 156, including ESR 140.16 and ESR 153.3. Installing the stated fixed releases removes the defect.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, meaning the likelihood of exploitation is low. Based on the description, it is inferred that the attack would require an attacker to supply or manipulate content that is copied, pasted, or dropped—typically through a malicious web page, file, or document—so the primary vector is user‑initiated action. The vulnerability would allow bypassing the DOM mitigations but the description does not explicitly state that it leads to code execution; instead it enables injection of content that the browser normally rejects.