This vulnerability involves a race condition in Mozilla Firefox that could result in private browsing tabs being opened within normal browsing windows, thereby risking the exposure of private browsing activity. It was reported by Maruf Bin Murtuza and tracked as Bug 1932555. The issue was resolved in Firefox 135 and Firefox ESR 128.7 as part of a broader security update addressing multiple vulnerabilities. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no impact on availability.

If exploited, this vulnerability could lead to a privacy leak by exposing private browsing tabs in normal browsing windows, potentially allowing sensitive browsing information to be observed or accessed inappropriately. However, the impact is rated as low to medium since it does not directly lead to code execution or system compromise. No known active exploits have been reported.

A fix for this vulnerability is available and has been incorporated in Mozilla Firefox 135 and Firefox ESR 128.7. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. Since the vulnerability is fixed in official releases, no additional mitigation steps are required.