What is the CVSS score of CVE-2026-8965?

CVE-2026-8965 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mozilla Firefox are affected by CVE-2026-8965?

Mozilla Firefox versions prior to 151 contain a DOM security vulnerability enabling remote, unauthenticated attackers to exfiltrate sensitive organizational data without user interaction; no public…. A patch is available.

How to fix or mitigate CVE-2026-8965?

24 hours: Conduct complete inventory of Firefox installations across the organization; identify all systems running versions prior to 151 and prioritize machines processing sensitive data for interim mitigation. Assess feasibility of deploying browser isolation or network segmentation to reduce risk exposure. 7 days: Establish daily monitoring of Mozilla security advisories for Firefox 151 release; prepare patch testing protocol and identify preferred deployment method (managed update, manual rollout, etc.). 30 days: Deploy Firefox 151 or later to all affected endpoints; verify successful patch application and confirm closure of the DOM security vulnerability.

Mozilla Firefox CVE-2026-8965

EUVD-2026-30913 HIGH

Information Exposure (CWE-200)

2026-05-19 mozilla

GHSA-572x-vhpq-w4gm

Information Disclosure Mozilla Suse

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 17:25 vuln.today

CVSS changed

May 20, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

May 19, 2026 - 12:30 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151.

AnalysisAI

Information disclosure in Mozilla Firefox prior to version 151 allows remote attackers to leak sensitive data through a flaw in the DOM: Security component, exploitable without authentication or user interaction. The CVSS 7.5 rating reflects high confidentiality impact via network vector, though EPSS scoring at 0.02% (4th percentile) indicates very low predicted exploitation probability and no public exploit identified at time of analysis.

RemediationAI

24 hours: Conduct complete inventory of Firefox installations across the organization; identify all systems running versions prior to 151 and prioritize machines processing sensitive data for interim mitigation. Assess feasibility of deploying browser isolation or network segmentation to reduce risk exposure. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory