diff --git a/browser/extensions/webcompat/manifest.json b/browser/extensions/webcompat/manifest.json
index ebd67c05e5e..ec2f3f2f749 100644
--- a/browser/extensions/webcompat/manifest.json
+++ b/browser/extensions/webcompat/manifest.json
@@ -2,7 +2,7 @@
   "manifest_version": 2,
   "name": "Web Compatibility Interventions",
   "description": "Urgent post-release fixes for web compatibility.",
-  "version": "148.3.0",
+  "version": "148.4.0",
   "browser_specific_settings": {
     "gecko": {
       "id": "[email protected]",
diff --git a/browser/extensions/webcompat/shims/disqus-embed.js b/browser/extensions/webcompat/shims/disqus-embed.js
index 8fbd1f8dd20..3bcfadaa943 100644
--- a/browser/extensions/webcompat/shims/disqus-embed.js
+++ b/browser/extensions/webcompat/shims/disqus-embed.js
@@ -8,11 +8,33 @@ if (!window.smartblockDisqusShimInitialized) {
   // Guard against this script running multiple times
   window.smartblockDisqusShimInitialized = true;
 
+  /**
+   * Finds a Disqus embed script URL in the document. Validates that
+   * the URL matches https://*.disqus.com/embed.js format.
+   *
+   * @returns {string|undefined} The script URL if found, undefined otherwise.
+   */
+  function getDisqusEmbedScriptURL() {
+    for (const script of document.querySelectorAll("script[src]")) {
+      try {
+        const url = new URL(script.src);
+        if (
+          url.protocol === "https:" &&
+          url.hostname.endsWith(".disqus.com") &&
+          url.pathname === "/embed.js"
+        ) {
+          return url.href;
+        }
+      } catch {
+        // Invalid URL, skip
+      }
+    }
+    return undefined;
+  }
+
   // Get the script URL from the page. We can't hardcode it because the
   // subdomain is site specific.
-  let scriptURL = document.querySelector(
-    'script[src*=".disqus.com/embed.js"]'
-  )?.src;
+  const scriptURL = getDisqusEmbedScriptURL();
   if (scriptURL) {
     embedHelperLib.initEmbedShim({
       shimId: "DisqusEmbed",