CVE-2026-6756
Published: 21 April 2026
Summary
CVE-2026-6756 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 12.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-10 (Software Usage Restrictions).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely remediation of the mitigation bypass vulnerability in Firefox for Android by applying the patch in version 150.
Enables vulnerability scanning to identify and prioritize systems running vulnerable versions of Firefox for Android affected by CVE-2026-6756.
Restricts execution to authorized, patched versions of Firefox for Android, preventing use of instances vulnerable to CVE-2026-6756.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote no-interaction client-side browser mitigation bypass with high integrity impact directly enables exploitation for client execution in a browser application.
NVD Description
Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150.
Deeper analysisAI
CVE-2026-6756 is a mitigation bypass vulnerability (CWE-200) in Firefox for Android, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Published on 2026-04-21, it allows attackers to circumvent security mitigations implemented in the browser.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation results in high integrity impact, enabling modification of data or behavior without affecting confidentiality or availability.
Mozilla addressed this issue in Firefox 150, as detailed in their security advisory (MFSA 2026-30) and Bugzilla entry 1992585. Security practitioners should ensure Firefox for Android instances are updated to version 150 or later to mitigate the risk.
Details
- CWE(s)