CVE-2026-8961: Mozilla Firefox Auth Bypass Vulnerability

CVE-2026-8961 Overview

CVE-2026-8961 is a spoofing vulnerability in the Form Autofill component of Mozilla Firefox and Thunderbird. The flaw allows an attacker-controlled web page to manipulate the autofill user interface and trick users into submitting sensitive data to unintended recipients. Mozilla addressed the issue in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. The weakness is classified as [CWE-290] Authentication Bypass by Spoofing. Exploitation requires user interaction, such as visiting a crafted page and engaging with autofill prompts.

Critical Impact

Successful exploitation enables an attacker to spoof autofill behavior, leading to integrity compromise of user-submitted form data including potentially sensitive personal information.

Affected Products

• Mozilla Firefox (versions prior to 151)
• Mozilla Firefox ESR (versions prior to 140.11)
• Mozilla Thunderbird (versions prior to 151 and 140.11)

Discovery Timeline

• 2026-05-19 - CVE-2026-8961 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-8961

Vulnerability Analysis

The vulnerability resides in the Form Autofill component used by Firefox and Thunderbird. Form Autofill is responsible for suggesting and inserting previously stored values such as names, addresses, and payment details into HTML form fields. The component fails to properly enforce trust boundaries between page-controlled content and the browser-managed autofill interface. As a result, a malicious site can present misleading context to the user during the autofill interaction.

Because the component is shared across Mozilla products, the same defect affects both the Firefox browser and the Thunderbird mail client. The issue is tracked as [CWE-290], indicating that authenticity assumptions made by the autofill flow can be bypassed through spoofing.

Root Cause

The root cause is insufficient validation of the visual and contextual relationship between the form requesting data and the autofill prompt presented to the user. Page content is able to influence what the user perceives when selecting an autofill entry, breaking the implicit trust that values inserted via autofill match the form field the user intended to populate.

Attack Vector

An attacker hosts a crafted web page that includes form fields and supporting markup designed to manipulate the autofill UI. When a victim visits the page and interacts with the form, the autofill component can be coerced into submitting stored values to attacker-controlled fields. The attack is network-delivered and requires user interaction. It does not require prior authentication or elevated privileges. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. See Mozilla Bug Report #1962625 for technical context.

Detection Methods for CVE-2026-8961

Indicators of Compromise

• Outbound form submissions from Firefox or Thunderbird containing autofill profile data sent to unexpected third-party domains.
• Browser telemetry showing autofill events on pages with hidden, off-screen, or oddly-styled form fields.
• Endpoints running Firefox versions earlier than 151 or ESR earlier than 140.11, or Thunderbird earlier than 151 or 140.11.

Detection Strategies

• Inventory installed Mozilla products and compare against patched versions to identify exposed endpoints.
• Inspect web proxy and DNS logs for form POST submissions to recently registered or low-reputation domains following user browsing activity.
• Correlate browser process activity with credential or PII-shaped data in outbound HTTP traffic.

Monitoring Recommendations

• Monitor enterprise software inventory feeds for Firefox and Thunderbird version drift below the fixed releases.
• Alert on installation of outdated Mozilla packages through patch management telemetry.
• Track user reports of unexpected autofill behavior or data appearing in fields users did not intend to populate.

How to Mitigate CVE-2026-8961

Immediate Actions Required

• Update Firefox to version 151 and Firefox ESR to 140.11 on all managed endpoints.
• Update Thunderbird to version 151 or 140.11 across user workstations and mail clients.
• Validate via inventory tooling that no downgraded or pinned older versions remain in production.

Patch Information

Mozilla released fixes in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Patch details are documented in Mozilla Security Advisory MFSA-2026-46, MFSA-2026-48, MFSA-2026-50, and MFSA-2026-51.

Workarounds

• Disable Form Autofill in Firefox preferences under Privacy & Security until patches are deployed.
• Remove stored addresses and payment methods from the autofill profile on endpoints that cannot be immediately updated.
• Instruct users to manually type sensitive data on unfamiliar sites rather than relying on autofill suggestions.

# Configuration example: disable Form Autofill via Firefox policy
# /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableFormHistory": true,
    "Preferences": {
      "extensions.formautofill.addresses.enabled": {
        "Value": false,
        "Status": "locked"
      },
      "extensions.formautofill.creditCards.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}