CVE-2026-8961 is a spoofing vulnerability affecting the Form Autofill component in Mozilla Firefox. Spoofing vulnerabilities typically involve tricking users into believing that malicious content is legitimate by manipulating UI elements or data presentation. This specific vulnerability was addressed and fixed in Firefox 151 and Firefox ESR 140.11. The CVSS v3.1 base score is 6.5, with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisories from Mozilla confirm the fix and provide additional context on related vulnerabilities patched in the same releases.

The vulnerability allows an attacker to spoof information in the Form Autofill component, potentially misleading users and causing them to enter sensitive data into malicious forms. The integrity of autofill data can be compromised, but there is no direct confidentiality or availability impact. No known exploits have been reported in the wild, reducing immediate risk. The medium severity reflects the potential for user deception but limited direct system compromise.

This vulnerability is fixed in Firefox 151 and Firefox ESR 140.11. Users and administrators should update affected Firefox installations to these versions or later to mitigate the risk. Since the vendor advisory confirms the fix, no additional mitigation steps are required beyond applying the official update.