PT-2026-2652 · Mozilla+3 · Firefox Esr+4

Edgar Chen · Published 2026-01-13 · Updated 2026-03-18 · CVE-2026-0890

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 147 Firefox ESR versions prior to 140.7

Description A spoofing issue exists in the DOM Copy, Paste, and Drag & Drop components. The issue involves potential manipulation within these components, allowing for spoofing attacks.

Recommendations Update Firefox to version 147 or later. Update Firefox ESR to version 140.7 or later.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

ALSA-2026:0667

ALSA-2026:0694

ALSA-2026:0924

ALSA-2026:2220

ALSA-2026:2271

ALSA-2026:2286

BDU:2026-06699

CVE-2026-0890

MGASA-2026-0013

MGASA-2026-0014

OESA-2026-1085

OESA-2026-1086

OESA-2026-1087

OESA-2026-1088

OESA-2026-1089

OESA-2026-1090

OESA-2026-1264

OESA-2026-1285

OPENSUSE-SU-2026:10037-1

OPENSUSE-SU-2026:10046-1

OPENSUSE-SU-2026:10058-1

OPENSUSE-SU-2026:20041-1

OPENSUSE-SU-2026:20391-1

RHSA-2026:0667

RHSA-2026:0694

RHSA-2026:0924

RHSA-2026:1320

RHSA-2026:1413

RHSA-2026:1414

RHSA-2026:1415

RHSA-2026:1461

RHSA-2026:1462

RHSA-2026:1471

RHSA-2026:1487

RHSA-2026:2041

RHSA-2026:2043

RHSA-2026:2044

RHSA-2026:2047

RHSA-2026:2069

RHSA-2026:2070

RHSA-2026:2073

RHSA-2026:2074

RHSA-2026:2220

RHSA-2026:2231

RHSA-2026:2271

RHSA-2026:2286

SUSE-SU-2026:0122-1

SUSE-SU-2026:0153-1

SUSE-SU-2026:0260-1

SUSE-SU-2026:20086-1

USN-7991-1

Affected Products

Firefox

Firefox Esr

Linuxmint

Rocky Linux

Ubuntu

References · 315

• https://ubuntu.com/security/CVE-2025-9184 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6427 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6433 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9180 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-0890 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0241 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-0890 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13019 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0818 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13013 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13014 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6435 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0122-1 · Vendor Advisory