An information disclosure vulnerability in Mozilla Firefox and Thunderbird allows unauthenticated attackers to remotely expose sensitive data via the DevTools Framework component.

This is an information disclosure flaw located within the Framework component of the developer tools, requiring no user interaction and accessible over the network by unauthenticated attackers.

A successful exploit could lead to the unauthorized exposure of sensitive internal data or application states, posing significant risks to user privacy and enterprise confidentiality. Given its CVSS score of 7.5, this high severity rating reflects the capability of remote attackers to harvest sensitive information without requiring authentication or user interaction.

Immediate Action: Update Mozilla Firefox to version 153 or higher, Firefox ESR to version 140.13 or higher, and Thunderbird to the corresponding fixed versions.

Proactive Monitoring: Monitor network traffic for anomalous access patterns targeting browser development endpoints or related telemetry data.

Compensating Controls: Restrict remote debugging capabilities and network access to development ports on vulnerable endpoints where immediate patching is not possible.

Public Exploit Available: No (false / unknown)

Security teams must treat this high severity information disclosure vulnerability with urgency due to its unauthenticated, remote attack vector. Organizations should deploy the vendor provided updates immediately across all affected Firefox and Thunderbird installations to eliminate potential data exposure risks.