CVE-2026-6762
DOM Spoofing Vulnerability in Firefox Core & HTML Components
Publication date: 2026-04-21
Last updated on: 2026-04-22
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | to 150.0 (exc) |
| mozilla | firefox | to 140.10.0 (exc) |
| mozilla | thunderbird | From 140.0 (inc) to 140.10.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a spoofing issue found in the DOM: Core & HTML component of Mozilla Firefox. It allows an attacker to potentially deceive users by manipulating the Document Object Model (DOM) in a way that misrepresents content or origin.
The issue was addressed and fixed in Firefox versions 150, Firefox ESR 115.35, and Firefox ESR 140.10.
How can this vulnerability impact me? :
This spoofing vulnerability could allow attackers to trick users by displaying misleading or falsified web content, potentially leading to phishing attacks or other forms of social engineering.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update Firefox to version 150 or later, or update Firefox ESR to versions 115.35 or 140.10 or later where the issue has been fixed.