CVE-2026-6759
Published: 21 April 2026
Summary
CVE-2026-6759 is a high-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 28.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-6759 is a use-after-free vulnerability (CWE-416) in the Widget: Cocoa component of Mozilla products, specifically affecting Firefox, Firefox ESR, and Thunderbird. Published on 2026-04-21, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.
The vulnerability can be exploited by remote attackers with no privileges or user interaction required, accessible over the network with low attack complexity. Exploitation results in a denial-of-service condition, such as application crashes, with no direct impact on confidentiality or integrity.
Mozilla's security advisories (MFSA 2026-30, MFSA 2026-32, MFSA 2026-33, and MFSA 2026-34), along with Bugzilla entry 2016164, confirm the issue was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Mitigation requires updating to these patched versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24100
Vulnerability details
Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free leads to application crashes enabling Endpoint Denial of Service via direct application exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identifying, prioritizing, and applying patches for known flaws like this use-after-free vulnerability fixed in updated Firefox and Thunderbird versions.
Ensures receipt and dissemination of security advisories such as MFSA 2026-30 through 34, enabling timely awareness and patching for this CVE.
Mandates vulnerability scanning to identify systems running vulnerable versions of Firefox, ESR, or Thunderbird affected by this use-after-free.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 8 (1 rule)
- V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 9 (1 rule)
- V-257794 RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416