A vulnerability in Mozilla Firefox and Thunderbird allows for a Content Security Policy bypass, potentially facilitating cross-site scripting or unauthorized data exposure.

The issue stems from improper propagation of the source document during XSLT document loading, which permits an attacker to bypass established Content Security Policy (CSP) restrictions. This attack is unauthenticated and requires user interaction, typically triggered by navigating to a malicious web page.

The ability to bypass CSP significantly weakens the security posture of the browser, allowing for potential cross-site scripting (XSS) attacks. With a CVSS score of 8.1, this represents a high-severity risk that could lead to unauthorized data access or the execution of malicious scripts within the context of trusted websites. Organizations relying on strict CSPs to protect internal applications face an elevated risk of session hijacking or sensitive information disclosure.

Immediate Action: Update Mozilla Firefox and Thunderbird to version 141 or higher, or the specified ESR releases (128.13 or 140.1) as identified in the vendor security advisories.

Proactive Monitoring: Monitor endpoint logs for suspicious browser activity or unexpected cross-origin requests that might indicate a CSP bypass attempt.

Compensating Controls: Ensure that all web applications utilize robust server-side security headers and input validation, as CSP should be treated as a defense-in-depth measure rather than a primary security control.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the nature of the vulnerability, administrators should prioritize the deployment of the latest browser updates. Patching remains the most effective method to restore the integrity of the Content Security Policy and protect end-user sessions from script-based attacks.