CVE-2026-0887

Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@mozilla.org

Published

2026-01-13

Last modified

2026-04-13

Weaknesses

CWE-497

Affected products

• Firefox (Mozilla)
• Thunderbird (Mozilla)

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=2006500
• https://www.mozilla.org/security/advisories/mfsa2026-01/
• https://www.mozilla.org/security/advisories/mfsa2026-03/
• https://www.mozilla.org/security/advisories/mfsa2026-04/
• https://www.mozilla.org/security/advisories/mfsa2026-05/