CVE-2026-6762
published 2026-04-21CVE-2026-6762: Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and…
PriorityP430medium6.3CVSS 3.1
AVNACLPRNUIRSUCLILAL
EPSS
0.16%
5.3th percentile
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < Firefox 150 | Firefox 150 |
| mozilla | firefox | < 140.10.0 | 140.10.0 |
| mozilla | firefox | < 150.0 | 150.0 |
| mozilla | firefox_esr | < Firefox ESR 115.35 | Firefox ESR 115.35 |
| mozilla | firefox_esr | < Firefox ESR 140.10 | Firefox ESR 140.10 |
| mozilla | thunderbird | < Thunderbird 140.10 | Thunderbird 140.10 |
| mozilla | thunderbird | < Thunderbird 150 | Thunderbird 150 |
| mozilla | thunderbird | >= 140.0 < 140.10.0 | 140.10.0 |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: Spoofing issue in the DOM: Core & HTML component
vendor_redhat·2026-04-21·CVSS 6.1
CVE-2026-6762 [MEDIUM] CWE-1021 firefox: Spoofing issue in the DOM: Core & HTML component
firefox: Spoofing issue in the DOM: Core & HTML component
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue:
Spoofing issue in the DOM: Core & HTML component
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Mozilla
Mozilla Foundation Security Advisory 2026-31: CVE-2026-6762
vendor_mozilla
CVE-2026-6762 Mozilla Foundation Security Advisory 2026-31: CVE-2026-6762
Mozilla Foundation Security Advisory 2026-31
CVE: CVE-2026-6762
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.35
Mozilla
Mozilla Foundation Security Advisory 2026-34: CVE-2026-6762
vendor_mozilla
CVE-2026-6762 Mozilla Foundation Security Advisory 2026-34: CVE-2026-6762
Mozilla Foundation Security Advisory 2026-34
CVE: CVE-2026-6762
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 140.10
Mozilla
Mozilla Foundation Security Advisory 2026-32: CVE-2026-6762
vendor_mozilla
CVE-2026-6762 Mozilla Foundation Security Advisory 2026-32: CVE-2026-6762
Mozilla Foundation Security Advisory 2026-32
CVE: CVE-2026-6762
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.10
Mozilla
Mozilla Foundation Security Advisory 2026-30: CVE-2026-6762
vendor_mozilla
CVE-2026-6762 Mozilla Foundation Security Advisory 2026-30: CVE-2026-6762
Mozilla Foundation Security Advisory 2026-30
CVE: CVE-2026-6762
Product: Firefox
Impact: high
Fixed in: Firefox 150
Mozilla
Mozilla Foundation Security Advisory 2026-33: CVE-2026-6762
vendor_mozilla
CVE-2026-6762 Mozilla Foundation Security Advisory 2026-33: CVE-2026-6762
Mozilla Foundation Security Advisory 2026-33
CVE: CVE-2026-6762
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 150
GHSA
python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
ghsa·2026-06-11
CVE-2026-48045 [MEDIUM] CWE-400 python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
### Impact
`AsyncListener.handle_query_or_defer` retained every truncated (TC-bit) incoming query in `self._deferred[addr]` and armed a per-addr timer in `self._timers[addr]` that flushed the reassembled query within ~500 ms (RFC 6762 §18.5). Neither the per-addr list nor the number of distinct `addr` keys was capped, and the dedup check (`for incoming in reversed(deferred): if incoming.data == msg.data`) ran O(N) over the per-addr list on every arrival.
Any unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can stream byte-distinct TC-flagged mDNS queries — each up to `_MAX_MSG_ABSOLUTE = 8966` bytes, with `DNSIncoming` retaining the raw `data` buffer plus
GHSA
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
ghsa·2026-05-29
CVE-2026-47184 [MEDIUM] CWE-400 zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
### Impact
`DNSCache._async_add` inserted every response record into `cache`, `_expirations`, `_expire_heap`, and `service_cache` with no cap on entry count. The only pre-existing protection was a PTR TTL floor (`_DNS_PTR_MIN_TTL = 1125` s, RFC 6762 §10), which actually *prolonged* attacker-injected records, and a periodic `async_expire` on `_CACHE_CLEANUP_INTERVAL = 10` s that could not keep up with a flood.
Any unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can multicast valid mDNS responses with unique names (RFC 6762 §11 allows up to 253 bytes each) and watch them accumulate. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardwar
GHSA
GHSA-h3rr-2q6v-g8rc: Spoofing issue in the DOM: Core & HTML component
ghsa_unreviewed·2026-04-21
CVE-2026-6762 [MEDIUM] CWE-290 GHSA-h3rr-2q6v-g8rc: Spoofing issue in the DOM: Core & HTML component
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10.
No detection rules found.
No public exploits indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=2021080https://www.mozilla.org/security/advisories/mfsa2026-30/https://www.mozilla.org/security/advisories/mfsa2026-31/https://www.mozilla.org/security/advisories/mfsa2026-32/https://www.mozilla.org/security/advisories/mfsa2026-33/https://www.mozilla.org/security/advisories/mfsa2026-34/
2026-04-21
Published