CVE-2026-6763
Published: 21 April 2026
Summary
CVE-2026-6763 is a medium-severity Protection Mechanism Failure (CWE-693) vulnerability in Mozilla Firefox. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 8.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2026-6763 is a mitigation bypass vulnerability in the File Handling component of Mozilla products, specifically affecting Firefox versions prior to 150, Firefox ESR versions prior to 140.10, Thunderbird versions prior to 150, and Thunderbird versions prior to 140.10. Published on 2026-04-21, it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is associated with CWE-693 (Protection Mechanism Failure).
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables limited impacts on confidentiality and integrity, allowing attackers to bypass mitigations in the File Handling component.
Mozilla security advisories (MFSA2026-30 through MFSA2026-34) and the associated Bugzilla entry detail the patch, recommending immediate upgrades to Firefox 150, Firefox ESR 140.10, Thunderbird 150, or Thunderbird 140.10 to mitigate the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24104
Vulnerability details
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Bypass of file handling mitigations in browser/email client enables remote exploitation for drive-by compromise and client execution without user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of vendor patches that close the mitigation-bypass flaw in the File Handling component.
Mandates integrity verification mechanisms that can detect or block unauthorized modification or bypass of file-handling protections.
Enforces configuration settings that restrict or harden file-handling behavior until the vulnerable component is replaced.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (2 rules)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-693
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. via CWE-693
Windows 10 (2 rules)
- V-220865 The Windows Remote Management (WinRM) service must not use Basic authentication. via CWE-693
- V-220812 Credential Guard must be running on Windows 10 domain-joined systems. via CWE-693
Windows 11 (1 rule)
- V-253418 The Windows Remote Management (WinRM) service must not use Basic authentication. via CWE-693
Windows Server 2016 (1 rule)
- V-225012 Windows Server 2016 must be running Credential Guard on domain-joined member servers. via CWE-693
Windows Server 2019 (1 rule)
- V-205907 Windows Server 2019 must be running Credential Guard on domain-joined member servers. via CWE-693
Windows Server 2022 (1 rule)
- V-254441 Windows Server 2022 must be running Credential Guard on domain-joined member servers. via CWE-693