A vulnerability in Firefox and Thunderbird prior to versions 132 and 128.4 ESR respectively allows cross-site scripting (XSS) attacks due to the Content-Disposition: attachment header being ignored in multipart/x-mixed-replace responses. This header was intended to force content to be downloaded rather than rendered, but its absence in enforcement could be exploited to execute malicious scripts.