Mozilla Firefox and Thunderbird XSS Vulnerability via OBJECT Tag Type Attribute

A vulnerability exists in Mozilla Firefox versions prior to 144, Firefox ESR versions prior to 140.4, Thunderbird versions prior to 144, and Thunderbird ESR versions prior to 140.4. A malicious page could exploit the type attribute of an OBJECT tag to alter the default browser behavior when handling web resources that lack a content-type. This manipulation could have facilitated a cross-site scripting (XSS) attack on websites that improperly serve files without a content-type header.

Impact

Exploitation of this vulnerability could have led to a cross-site scripting (XSS) attack on affected sites.

Remediation

Users can upgrade to Firefox 144, Firefox ESR 140.4, Thunderbird 144, or Thunderbird ESR 140.4 to address this vulnerability.