The vulnerability permits reading restricted data within the Networking component of Mozilla Firefox and Mozilla Thunderbird. This is a CWE-200 information disclosure flaw. The disclosed information could include sensitive data or configuration details. The primary impact is partial information disclosure that could aid further exploitation or compromise user privacy. The bug was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17, as well as Thunderbird 157, Thunderbird 140.17 and Thunderbird 153.4.

Mozilla Firefox and Mozilla Thunderbird users running affected editions. The vulnerability is present in Firefox ESR 140.17, Firefox ESR 153.4, Firefox 157, as well as Thunderbird 140.17, Thunderbird 153.4 and Thunderbird 157. These releases lack the patch that addresses the information leakage.

The CVSS score of 4.3 indicates a medium severity impact. The EPSS score indicates a very low exploitation probability (0.00197 < 1%), and the vulnerability is not listed in CISA’s KEV. The likely attack vector is inferred to be local or remote access to the affected browser installation, possibly triggered by malicious code or compromised content loading. Exploitation would involve accessing data through the networking code path exposed by the bug, which is mitigated in the patched releases. The flaw is identified as a CWE-200 information disclosure vulnerability.