CVE-2026-0890 is a spoofing vulnerability within the Document Object Model (DOM) specifically related to the Copy & Paste and Drag & Drop functionality in Mozilla Firefox. The flaw could allow attackers to present spoofed content during these interactions, potentially misleading users. The vulnerability was addressed and fixed in Firefox 147 and Firefox ESR 140.7, along with corresponding Thunderbird versions. The CVSS v3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

The vulnerability allows spoofing in the DOM Copy & Paste and Drag & Drop component, which could mislead users by displaying falsified content during these operations. The impact is rated as low to medium, with a CVSS score of 5.4. There are no reports of active exploitation in the wild. The vulnerability does not directly lead to code execution or significant data loss but could be used in social engineering or phishing attacks.

Mozilla has released official fixes for this vulnerability in Firefox 147 and Firefox ESR 140.7, as well as Thunderbird 147 and Thunderbird ESR 140.7. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official updates.