CVE-2026-74966: Firefox Form Autofill Disclosure Flaw

CVE-2026-74966 Overview

CVE-2026-74966 is an information disclosure vulnerability in the Form Autofill component of Mozilla Firefox and Thunderbird. The flaw allows a remote attacker to obtain sensitive data stored by the browser's autofill feature without requiring authentication or user interaction. Mozilla addressed the issue in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. The vulnerability is classified under CWE-359: Exposure of Private Personal Information to an Unauthorized Actor.

Critical Impact
A network-based attacker can exfiltrate autofill data such as names, addresses, or other saved form values from unpatched Firefox and Thunderbird clients.

Affected Products

Mozilla Firefox versions prior to 154
Mozilla Firefox ESR versions prior to 153.1
Mozilla Thunderbird versions prior to 154 and prior to 153.1

Discovery Timeline

2026-08-18 - CVE-2026-74966 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-74966

Vulnerability Analysis

The vulnerability resides in the Form Autofill component, which stores and injects user-provided data such as names, addresses, and other personal information into web forms. Under specific conditions, a crafted web page can trigger autofill behavior in a way that discloses stored values to the attacker-controlled origin. The confidentiality impact is high, while integrity and availability remain unaffected, consistent with a pure information disclosure flaw.

Because the attack targets the browser client directly, any user visiting a malicious page with a vulnerable Firefox or Thunderbird build can leak saved form data. Thunderbird is affected because it shares Gecko rendering components with Firefox, exposing message preview and remote content contexts to the same class of issue.

Root Cause

The root cause is improper handling of form field context within the autofill code path, permitting the disclosure of stored personal data to an unauthorized origin. This aligns with the CWE-359 weakness pattern for exposure of private personal information. Mozilla has not published exploitation details in the public advisories referenced by the CVE, and no proof-of-concept is available.

Attack Vector

The attack is executed remotely over the network with low complexity, no privileges, and no user interaction beyond loading attacker-controlled content. An attacker hosts a malicious page or delivers HTML content within a Thunderbird message context that abuses the vulnerable autofill logic. When the client processes the page, previously saved form data is exposed to the attacker.

See the Mozilla Security Advisory MFSA-2026-74, MFSA-2026-77, MFSA-2026-78, MFSA-2026-80, and Mozilla Bug #2054776 for vendor-provided technical context.

Detection Methods for CVE-2026-74966

Indicators of Compromise

Outbound HTTP or HTTPS requests from Firefox or Thunderbird processes containing form field values that were never submitted by the user.
Anomalous DOM interactions on suspicious pages that programmatically enumerate hidden or off-screen input fields.
Endpoint telemetry showing Firefox or Thunderbird versions older than 154 and ESR 153.1 remaining in production after the patch date.

Detection Strategies

Inventory browser and mail client versions across the fleet and flag any host running Firefox below 154, Firefox ESR below 153.1, or Thunderbird below 154 or 153.1.
Inspect proxy and DNS logs for requests to newly registered or low-reputation domains loaded shortly before outbound form-shaped data appears in POST bodies or query strings.
Correlate browser process telemetry with network egress to identify autofill-triggered form submissions to unexpected destinations.

Monitoring Recommendations

Enable version telemetry from EDR agents to continuously report Gecko-based application versions.
Alert on Thunderbird rendering remote content from external senders when combined with outbound web requests.
Track user reports of unexpected autofill prompts on unfamiliar sites.

How to Mitigate CVE-2026-74966

Immediate Actions Required

Update Firefox to version 154 or later on all managed endpoints.
Update Firefox ESR deployments to version 153.1 or later.
Update Thunderbird to version 154 or 153.1 depending on the release channel in use.
Restart affected applications after patching to ensure the vulnerable Gecko components are unloaded.

Patch Information

Mozilla fixed the issue in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. Refer to MFSA-2026-74, MFSA-2026-77, MFSA-2026-78, and MFSA-2026-80 for the vendor's release notes and download locations.

Workarounds

Disable Form Autofill in Firefox by setting extensions.formautofill.addresses.enabled and extensions.formautofill.creditCards.enabled to false in about:config until patching is complete.
Clear stored autofill profiles under Settings, Privacy & Security, Forms and Autofill.
Block remote content in Thunderbird message previews and restrict HTML rendering for untrusted senders.
Enforce browser upgrade policies through enterprise configuration management to prevent version drift.

bash

# Configuration example: disable Form Autofill via Firefox enterprise policy (policies.json)
{
  "policies": {
    "Preferences": {
      "extensions.formautofill.addresses.enabled": {
        "Value": false,
        "Status": "locked"
      },
      "extensions.formautofill.creditCards.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}