An information disclosure flaw in the IP Protection component of Mozilla Firefox and Thunderbird enables remote attackers to access sensitive information without user interaction.

This vulnerability affects the IP Protection component, which is designed to obfuscate user network identities. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that the vulnerability is remotely exploitable without authentication or user interaction.

The failure of the IP Protection component can lead to the exposure of internal network configurations or user-specific metadata. Given the 7.5 CVSS score, this represents a high risk to user anonymity and organizational privacy, potentially enabling further targeted attacks by adversaries who gain visibility into internal network structures.

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or later to patch the IP Protection logic.

Proactive Monitoring: Monitor network traffic for unusual patterns originating from browser-based IP masking services.

Compensating Controls: Deploy enterprise-grade VPNs or secure gateways to provide additional layers of network identity protection while browsers are being updated.

Public Exploit Available: Unknown.

The risk associated with this information disclosure is high due to the lack of required user interaction for successful exploitation. Organizations must prioritize the rollout of version 151 to ensure the integrity of the browser's privacy-protecting features.