Exploit for Exposure of Private Personal Information to an Unauthorized Actor in Mozilla Firefox

## https://sploitus.com/exploit?id=4BBD844A-1D89-5DBC-A60C-E9C7B87C249C
# SkeletonKey

### CVE-2026-6765 · Test only FormAutofill handlers exposed in production Firefox

Severity sec moderate. CWE 284 and CWE 862 and CWE 749. Fixed in Firefox 150 and ESR 140.10. Bugzilla 2022419. Bounty awarded.

## Summary

Four message handlers in `FormAutofillParent.sys.mjs` are meant for automated testing only. They shipped in production without a `Cu.isInAutomation` guard. The actor is registered with `allFrames` and no origin restriction. Any content process can call them. The handlers read every saved card and address. They inject arbitrary autofill data. They delete saved payment methods by GUID.

## The exposed handlers

```
FormAutofill:GetRecords        returns all saved cards and addresses
FormAutofill:SaveAddress       injects an arbitrary address
FormAutofill:SaveCreditCard    injects an arbitrary card
FormAutofill:RemoveCreditCards deletes cards by GUID
```

## Proof of concept

The screenshot below is a live run on a vulnerable Firefox. The unguarded handler returns the saved record in full. The data is synthetic and the demonstration is local.

![Exfiltration through the unguarded handler](exfiltration.png)

Open the Browser Console on an affected build and run `poc.js`. It retrieves the FormAutofill parent actor. It exfiltrates every saved card and address. It then demonstrates injection and mass deletion.

## Impact

Full exfiltration of saved cards and addresses from a compromised content process. Silent injection of attacker autofill data that persists across sessions. Destructive deletion of all saved payment methods. Each is reachable with a single message.

## Fix

Guard every test only handler.

```js
if (!Cu.isInAutomation) {
  throw new Error("Test-only message received outside automation");
}
```

## Credit

Abdulaziz Alasaiqah · https://azoz.my/writeups.html