CVE-2026-0887

MEDIUM 4.3CVE-2026-0887 · Published 13/01/2026 · updated 17/06/2026

In short

CVE-2026-0887 is a MEDIUM (CVSS 4.3) vulnerability affecting firefox (mozilla), thunderbird (mozilla).
Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 25.8% of all vulnerabilities.
Fix: update to 140.7.0, 147.0 or later.

Package	Affected versions	Patched versions
firefox mozilla	`< 140.7.0< 147.0`	`140.7.0147.0`
thunderbird mozilla	`< 140.7.0< 147.0`	`140.7.0147.0`

Description

Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

References

bugzilla.mozilla.org/show_bug.cgi · Permissions Required
mozilla.org/security/advisories/mfsa2026-01 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-03 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-04 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-05 · Vendor Advisory

More vulnerabilities in firefox

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

firefox

mozilla

< 140.7.0< 147.0

140.7.0147.0

thunderbird

mozilla

< 140.7.0< 147.0

140.7.0147.0

More vulnerabilities in firefox

See all →