CVE-2026-0887 is a clickjacking vulnerability causing information disclosure in the PDF Viewer component of Mozilla Firefox. It allows an attacker to potentially trick users into unintended interactions, leading to disclosure of information. The vulnerability has been addressed and fixed in Firefox 147 and Firefox ESR 140.7 releases. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with network attack vector, low attack complexity, no privileges required, user interaction needed, and limited confidentiality impact. The vendor advisory confirms the fix and provides no indication of active exploitation.

The vulnerability could allow an attacker to perform clickjacking attacks that result in limited information disclosure through the PDF Viewer component. There is no indication of integrity or availability impact. No known exploits have been reported in the wild. The issue requires user interaction and can be exploited remotely over the network.

This vulnerability has been fixed in Mozilla Firefox 147 and Firefox ESR 140.7. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required as the vendor advisory confirms the availability of an official fix.