CVE-2026-4728
Published: 24 March 2026
Description
Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Reveals spoofed logon attempts through unexpected previous logon timestamps upon legitimate login.
Training specifically addresses recognizing spoofed communications and phishing that enable authentication bypass.
Requiring verifiable identity evidence at appropriate assurance levels makes it substantially harder for attackers to successfully spoof or impersonate users to obtain accounts.
Unique device authentication makes successful spoofing of device identity substantially more difficult to achieve.
Unique identification of non-organizational users reduces the feasibility of authentication bypass by spoofing.
Unique identification and authentication of services before communications makes spoofing of service identities substantially harder.
Isolated trusted path ensures the user interacts only with genuine system components, preventing spoofing of authentication interfaces or prompts.
Directly counters DNS response spoofing by requiring cryptographic origin authentication artifacts from the authoritative source.
Security SummaryAI
CVE-2026-4728 is a spoofing vulnerability (CWE-290) in the Privacy: Anti-Tracking component of Mozilla Firefox and Thunderbird. The issue allows attackers to bypass authentication mechanisms through spoofing, earning a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), classified as medium severity. It was addressed in Firefox version 149 and Thunderbird version 149.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low complexity, but requires user interaction to succeed. Successful exploitation results in high integrity impact, enabling attackers to spoof anti-tracking protections without affecting confidentiality or availability.
Mozilla's security advisories (MFSA 2026-20 and MFSA 2026-23) detail the fix, recommending immediate upgrade to Firefox 149 or Thunderbird 149. Additional technical details are available in Bugzilla entry 2013179.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Spoofing-based auth bypass in browser anti-tracking directly enables adversary-in-the-middle attacks by allowing forged or impersonated tracking/auth signals.