CVE-2026-8961

MediumCVSS 6.5

Published: 19/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

A Spoofing vulnerability in the Form Autofill component of Firefox and Thunderbird. The issue was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Risk Assessment

The risk involves potential spoofing of legitimate forms, which could lead to theft of personal data or other sensitive information.

Recommendation

Update Firefox to version 151 or later, Thunderbird to version 151 or later, and Firefox ESR to version 140.11.

Original NVD description (English source)

Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.