CVE-2026-6765

CVE-2026-6765 is an information disclosure vulnerability in the Form Autofill component affecting Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The vulnerability allows unauthorized access to sensitive information through the autofill functionality in these applications. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no user interaction or special privileges. The attack has low complexity and results in confidentiality impact with no integrity or availability concerns. The EPSS probability score of 0.00033 indicates this vulnerability is among the lower-probability CVEs for exploitation. There is no evidence of active exploitation in the wild, no public exploit code availability, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The moderate FAUCET risk score of 41.0 and inactive status on security hot lists suggest limited community attention and exploitation risk. Organizations should prioritize patching based on their Firefox and Thunderbird deployment scope.