What is the CVSS score of CVE-2026-8961?

CVE-2026-8961 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8961?

Yes, a patch is available for CVE-2026-8961. Update the affected software to the latest version immediately.

Mozilla Firefox CVE-2026-8961

EUVD-2026-30912 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-05-19 mozilla

GHSA-5qxp-cr8v-39px

Mozilla Authentication Bypass Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

3.4 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 17:29 vuln.today

CVSS changed

May 20, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

May 19, 2026 - 12:29 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.

AnalysisAI

Spoofing via the Form Autofill component in Mozilla Firefox allows a network-based attacker to achieve high integrity impact against users who interact with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms no authentication is required from the attacker side, but a victim must interact with malicious content for the attack to succeed. No public exploit code has been identified at time of analysis, and EPSS sits at 0.02% (5th percentile), indicating very low observed exploitation probability; the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-290 (Authentication Bypass by Spoofing) describes a root cause where an attacker can impersonate or falsify data in a way that bypasses trust assumptions. In the context of Firefox's Form Autofill component - responsible for automatically populating form fields with stored addresses, credentials, or payment data - a spoofing flaw could allow a malicious page to manipulate what data is presented or injected into form fields, deceiving users into submitting data to unintended recipients or accepting falsified autofill suggestions. The affected CPE (cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*) covers all Firefox versions across platforms prior to the fix. ENISA EUVD ID EUVD-2026-30912 corroborates the NVD entry.

RemediationAI

Upgrade to Mozilla Firefox 151 or Mozilla Firefox ESR 140.11, the vendor-released patched versions confirmed across multiple Mozilla security advisories (mfsa2026-46 at https://www.mozilla.org/security/advisories/mfsa2026-46/, mfsa2026-48, mfsa2026-50, and mfsa2026-51). For environments where immediate browser updates are not possible, a compensating control is to disable the Form Autofill feature via enterprise policy (setting AutofillAddressEnabled and AutofillCreditCardEnabled to false in Firefox policy templates), which eliminates the vulnerable component's attack surface at the cost of losing autofill functionality for end users. Organizations using Firefox ESR in managed environments should prioritize deploying 140.11 through their endpoint management tooling, as the ESR channel exists specifically for controlled enterprise update cycles.

More in Mozilla

View all

CVE-2015-4495 HIGH Act Now POC

8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote

CVE-2013-1690 HIGH Act Now POC

8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2013-0753 CRITICAL Act Now POC

9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2013-1710 CRITICAL Emergency POC

10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2014-1511 CRITICAL Emergency POC

9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo

CVE-2013-0643 HIGH Act Now

8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all

CVE-2024-54085 CRITICAL

9.8

CVE-2023-50224 MEDIUM

6.5

CVE-2024-4358 CRITICAL POC

9.8

CVE-2018-5353 CRITICAL POC

9.8

CVE-2023-51350 CRITICAL POC

9.8

CVE-2022-3180 CRITICAL

9.8

CVE-2025-66570 CRITICAL POC

10.0

CVE-2025-49002 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-8961 vulnerability details – vuln.today

Back

Mozilla Firefox CVE-2026-8961

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mozilla

Same weakness CWE-290 – Authentication Bypass by Spoofing

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code