CVE-2026-6749
Published: 21 April 2026
Summary
CVE-2026-6749 is a high-severity Use of Uninitialized Resource (CWE-908) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-6749 is an information disclosure vulnerability caused by uninitialized memory in the Graphics: Canvas2D component of Mozilla Firefox and Thunderbird. Classified under CWE-908, it received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and was published on 2026-04-21. The flaw affects versions of Firefox prior to 150, Firefox ESR prior to 115.35 and 140.10, Thunderbird prior to 150, and Thunderbird prior to 140.10.
Remote attackers can exploit this vulnerability over the network with low attack complexity, without requiring user privileges or interaction. Exploitation enables high-impact confidentiality violations by leaking contents of uninitialized memory through the Canvas2D interface, potentially exposing sensitive data rendered or processed in the browser.
Mozilla's security advisories MFSA 2026-30, MFSA 2026-31, MFSA 2026-32, and MFSA 2026-33, along with Bugzilla entry 2022610, document the issue and confirm fixes in the specified versions. Mitigation requires updating to Firefox 150, Firefox ESR 115.35 or 140.10, Thunderbird 150, or Thunderbird 140.10.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24090
Vulnerability details
Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws like the uninitialized memory disclosure in Firefox's Canvas2D component via patching to fixed versions.
Mandates memory protections that specifically prevent the disclosure of uninitialized memory, directly countering the core mechanism of this CVE.
Ensures receipt, dissemination, and implementation of vendor security advisories like Mozilla's MFSA bulletins addressing this vulnerability, enabling prompt updates.