CVE-2026-0890
Medium · 5.4CVSS
5.4
EPSS
0.3%
Published
Jan 13, 2026
CISA due date
—
The record
Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:9 | firefox | 0 | 140.7.0-1.el9_7.alma.1 |
| AlmaLinux:9 | firefox-x11 | 0 | 140.7.0-1.el9_7.alma.1 |
| AlmaLinux:9 | thunderbird | 0 | 140.7.0-1.el9_7.alma.1 |
| Mageia:9 | firefox | 0 | 140.7.0-1.mga9 |
| Mageia:9 | firefox-l10n | 0 | 140.7.0-1.mga9 |
| Mageia:9 | nss | 0 | 3.120.0-1.mga9 |
| Mageia:9 | thunderbird | 0 | 140.7.0-1.mga9 |
| Mageia:9 | thunderbird-l10n | 0 | 140.7.0-1.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | MozillaThunderbird | 0 | 140.7.0-150200.8.251.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | MozillaThunderbird | 0 | 140.7.0-150200.8.251.1 |
| openSUSE:Leap 15.6 | MozillaFirefox | 0 | 140.7.0-150200.152.216.1 |
| openSUSE:Leap 15.6 | MozillaThunderbird | 0 | 140.7.0-150200.8.251.1 |
| openSUSE:Leap 16.0 | MozillaFirefox | 0 | 140.7.0-160000.1.1 |
| openSUSE:Leap 16.0 | MozillaThunderbird | 0 | 140.8.1-bp160.1.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 147.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.7.0-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 140.7.0-1.1 |
Related vulnerabilities
- CVE-2026-0885 Use-after-free in the JavaScript: GC component. Also affects firefox
- CVE-2026-0886 Incorrect boundary conditions in the Graphics component. Also affects firefox
- CVE-2026-0887 Clickjacking issue, information disclosure in the PDF Viewer component. Also affects firefox
- CVE-2026-0891 Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and… Also affects firefox
- CVE-2026-0877 Mitigation bypass in the DOM: Security component. Also affects firefox
- CVE-2026-0883 Information disclosure in the Networking component. Also affects firefox
- CVE-2026-0878 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL… Also affects firefox
- CVE-2026-0884 Use-after-free in the JavaScript Engine component. Also affects firefox