A critical cookie-shadowing vulnerability in Mozilla Firefox and Thunderbird allows attackers to bypass security attributes, potentially leading to session hijacking or data exposure.

This vulnerability involves improper cookie parsing where a nameless cookie containing an equals sign can shadow other cookies. This is an unauthenticated, network-based attack vector that does not require user interaction.

By shadowing cookies that utilize the 'Secure' attribute, an attacker could potentially intercept or manipulate sensitive session data transmitted over HTTP. Given the 9.1 CVSS score, this flaw poses a severe risk to user authentication and data privacy, as it essentially nullifies the security protections intended to keep cookies isolated and protected.

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 140.1 or later immediately.

Proactive Monitoring: Monitor web traffic patterns for anomalies related to cookie headers and session management.

Compensating Controls: Enforce strict HSTS (HTTP Strict Transport Security) policies and use secure, HttpOnly cookies where possible to reduce the risk of session-based attacks.

Public Exploit Available: Unknown

This vulnerability represents a significant threat to browser-based security. IT administrators must ensure that all instances of Firefox and Thunderbird are updated to the fixed versions to protect user sessions from potential interception and shadowing attacks.