A same-origin policy bypass in the Mozilla Firefox and Thunderbird DOM Notifications component exposes users to significant data confidentiality risks.

The vulnerability is a same-origin policy bypass located within the DOM Notifications component. This flaw is unauthenticated, as it does not require prior user privileges to exploit, though it requires user interaction to trigger the malicious notification flow.

The ability to bypass the same-origin policy permits an attacker to read sensitive data across different origins, which can lead to the theft of session tokens, personal information, or proprietary business data. With a CVSS score of 8.1, this is a High severity vulnerability that could result in significant reputational damage and regulatory non-compliance if user privacy is compromised.

Immediate Action: Update Mozilla Firefox and Thunderbird to version 145 or the ESR 140.5 release immediately to apply the vendor-provided security patches.

Proactive Monitoring: Monitor browser and email client logs for unusual script execution patterns or unauthorized cross-origin requests that may indicate an attempt to leverage this bypass.

Compensating Controls: Implement browser security policies, such as strict Content Security Policies (CSP), to limit the scope of potential cross-origin interactions while the update deployment is in progress.

Public Exploit Available: No — exploit_available (false).

Given the High severity of this same-origin policy bypass, IT administrators must prioritize the deployment of the Mozilla security updates. Ensuring all instances of Firefox and Thunderbird are patched to version 145 or ESR 140.5 is essential to protect against potential cross-origin data theft and maintain the integrity of user sessions.