CVE-2026-6762 is a spoofing vulnerability affecting the DOM: Core & HTML component in Mozilla Firefox and Thunderbird. Spoofing vulnerabilities can allow an attacker to deceive users or systems by presenting false information or content. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS v3.1 base score is 6.3, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability rated as low. The vendor advisories from Mozilla confirm the fix and provide detailed references.

The vulnerability could allow an attacker to perform spoofing attacks within the affected components, potentially misleading users or systems. The CVSS score of 6.3 reflects a moderate impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild. The fix has been released in Firefox 150 and ESR versions 115.35 and 140.10, mitigating the risk.

A fix for CVE-2026-6762 is available and has been incorporated into Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official updates.