CVE-2026-0888 is an information disclosure vulnerability classified under CWE-200 affecting the XML component in Mozilla Firefox. The vulnerability could allow an attacker to gain access to information that should be protected. It has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. Mozilla fixed this issue in Firefox 147 and Thunderbird 147 as part of a security update addressing multiple vulnerabilities.

The vulnerability allows unauthorized disclosure of information via the XML component, potentially exposing sensitive data to remote attackers without requiring user interaction or privileges. The impact is limited to confidentiality with no effect on integrity or availability. There are no reports of exploitation in the wild. The medium severity reflects the moderate risk posed by the information disclosure.

This vulnerability is fixed in Mozilla Firefox 147 and Thunderbird 147. Users and administrators should update to these versions or later to remediate the issue. Since the vendor advisory confirms the fix, no additional mitigation steps are required beyond applying the official update.