A clickjacking vulnerability in Firefox versions prior to 139 and Firefox ESR prior to 128.11 could have been exploited to trick users into leaking saved payment card details to malicious web pages. This vulnerability has been addressed in Firefox 139 and Firefox ESR 128.11. The issue is rated with a medium severity and has a CVSS score of 5.4. No known exploits in the wild have been reported for this vulnerability.