CVE-2026-6765

Information disclosure in the Form Autofill component

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Affected

Mozilla · Firefox · Thunderbird

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 28th percentile

Published

2026-04-21

Updated

2026-05-27

Proof-of-concept exploits (1)

• defineid/SkeletonKey0★ · 2026-08-25

Security advisories

• https://www.mozilla.org/security/advisories/mfsa2026-30
• https://www.mozilla.org/security/advisories/mfsa2026-32
• https://www.mozilla.org/security/advisories/mfsa2026-33
• https://www.mozilla.org/security/advisories/mfsa2026-34

References

• CVE Record
• NVD entry

Related

• CVE-2026-74943
• CVE-2026-74945
• CVE-2026-74970