CVE-2026-6756
Published: 21 April 2026
Summary
CVE-2026-6756 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 14.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-10 (Software Usage Restrictions).
Deeper analysis
CVE-2026-6756 is a mitigation bypass vulnerability (CWE-200) in Firefox for Android, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Published on 2026-04-21, it allows attackers to circumvent security mitigations implemented in the browser.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation results in high integrity impact, enabling modification of data or behavior without affecting confidentiality or availability.
Mozilla addressed this issue in Firefox 150, as detailed in their security advisory (MFSA 2026-30) and Bugzilla entry 1992585. Security practitioners should ensure Firefox for Android instances are updated to version 150 or later to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24097
Vulnerability details
Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote no-interaction client-side browser mitigation bypass with high integrity impact directly enables exploitation for client execution in a browser application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the mitigation bypass vulnerability in Firefox for Android by applying the patch in version 150.
Enables vulnerability scanning to identify and prioritize systems running vulnerable versions of Firefox for Android affected by CVE-2026-6756.
Restricts execution to authorized, patched versions of Firefox for Android, preventing use of instances vulnerable to CVE-2026-6756.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. via CWE-200
Ubuntu 24.04 (2 rules)
- V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. via CWE-200
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-200
Windows 10 (1 rule)
- V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. via CWE-200
Windows Server 2016 (1 rule)
- V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
Windows Server 2019 (1 rule)
- V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
Windows Server 2022 (1 rule)
- V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200