CVE-2026-6765 is a medium severity information disclosure vulnerability affecting the Form Autofill component in Mozilla Firefox. The vulnerability allows an attacker to gain access to information that should be protected by the browser's autofill feature. It does not require privileges or user interaction to be exploited. Mozilla fixed this vulnerability in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The vendor advisories (MFSA2026-30 and MFSA2026-32) confirm the fix and provide additional context on related vulnerabilities addressed in the same releases.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive autofill data stored or managed by the browser. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, and no user interaction needed, resulting in confidentiality impact only. There are no reports of active exploitation in the wild. The vulnerability affects users running Firefox versions prior to 150 and ESR versions prior to 140.10.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should upgrade to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official updates.