A vulnerability in Thunderbird and Firefox allowed execution of javascript: URLs when used within object and embed tags. This issue affects multiple versions of Firefox and Thunderbird prior to their respective 141 releases and ESR versions before 128.13 and 140.1. The vulnerability could lead to high impact including potential code execution. Mozilla has addressed this issue in Firefox 141 and Thunderbird 141, as well as in Firefox ESR 128.13 and 140.1 and corresponding Thunderbird ESR versions.