CVE-2026-6765
Information Disclosure in Firefox Form Autofill Component
Publication date: 2026-04-21
Last updated on: 2026-04-22
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | to 150.0 (exc) |
| mozilla | firefox | to 140.10.0 (exc) |
| mozilla | thunderbird | to 140.10.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-359 | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an information disclosure issue in the Form Autofill component of Mozilla Firefox. It could potentially allow unauthorized access to information that is automatically filled into forms by the browser.
The issue was addressed and fixed in Firefox version 150 and Firefox ESR 140.10.
How can this vulnerability impact me? :
This vulnerability could lead to unauthorized disclosure of personal or sensitive information that the browser autofills into web forms, potentially exposing user data to attackers.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your Firefox browser to version 150 or later, or Firefox ESR to version 140.10 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves information disclosure in the Form Autofill component, which could potentially expose user data.
Information disclosure vulnerabilities can impact compliance with data protection regulations such as GDPR and HIPAA, as these standards require safeguarding personal and sensitive information from unauthorized access.
However, specific details on how this vulnerability affects compliance with these standards are not provided in the available information.