CVE-2026-6750
Mozilla Firefox ≤ 115.35.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-6750 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-2 (Account Management) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-6750 is a privilege escalation vulnerability (CWE-269: Improper Privilege Management) in the Graphics: WebRender component of Mozilla products. It affects Firefox versions prior to 150, Firefox ESR prior to 115.35 and 140.10, Thunderbird prior to 150, and Thunderbird prior to 140.10. The vulnerability was published on 2026-04-21 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Remote attackers require no privileges but must trick users into some interaction, such as visiting a malicious site or processing crafted content. Low attack complexity enables exploitation over the network, potentially granting elevated privileges within the affected browser or application, resulting in high impacts to confidentiality, integrity, and availability.
Mozilla Security Advisories (MFSA 2026-30, 2026-31, 2026-32, and 2026-33) and Bugzilla entry 2023407 detail the fix applied in the listed versions. Security practitioners should prioritize updating affected Firefox and Thunderbird installations to mitigate this issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24091
Vulnerability Data
Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 6 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Account management directly governs assignment and tracking of privileges so proper implementation stops the weakness from being introduced.
Requiring explicit access-control decisions ensures privileges are evaluated rather than assumed or omitted.
Access enforcement applies the correct privilege checks at every request, structurally preventing unintended spheres of control.
Separation of duties constrains how privileges may be assigned, reducing the chance of overly broad actor control.
Least privilege is the direct countermeasure to improper privilege management; implementing it eliminates the root cause.
Binding security attributes to subjects/objects supplies the mechanism needed to track and enforce privileges correctly.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly mandates determining access requirements, defining/enforcing topic-specific access control policy, assigning rights/restrictions by entity/role, consistency with classification, need-to-know, privileged access restrictions, segregation, formal authorization, and dynamic rules — which stops most improper privilege management from being exploitable; bounded remainder is flawed implementation of those rules (e.g. incorrect mapping or enforcement bugs).
A.5.18 directly governs the provisioning, review, modification and timely revocation of access rights (including for role changes, termination and privilege levels), which stops most improper privilege spheres from being exploitable even if the assignment flaw exists; the bounded remainder is flaws in the underlying enforcement mechanism itself (e.g. AC-3/A.8.3)
Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248551 A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. blocks CWE-266
Oracle Linux 9 (1 rule)
- V-271779 OL 9 must be configured so that a sticky bit must be set on all public directories. blocks CWE-266
RHEL 8 (1 rule)
- V-230243 A sticky bit must be set on all RHEL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. blocks CWE-266
RHEL 9 (1 rule)
- V-257929 A sticky bit must be set on all RHEL 9 public directories. blocks CWE-266
Ubuntu 22.04 (2 rules)
- V-260513 Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources. blocks CWE-266
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. blocks CWE-266
Ubuntu 24.04 (2 rules)
- V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. blocks CWE-266
- V-270750 Ubuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources. blocks CWE-266