CVE-2026-6770
Published: 21 April 2026
Summary
CVE-2026-6770 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Mozilla Firefox. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 8.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2026-6770 is an unspecified issue in the Storage: IndexedDB component of Mozilla Firefox and Thunderbird products. Published on 2026-04-21, it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) and is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Remote attackers require no privileges or user interaction to exploit this network-accessible vulnerability. Successful exploitation could result in low-impact confidentiality loss, such as exposure of sensitive information, and low-impact availability disruption.
Mozilla's security advisories MFSA2026-30, MFSA2026-32, MFSA2026-33, and MFSA2026-34, along with Bugzilla entry 2024220, detail the issue. Mitigation requires updating to the patched releases: Firefox 150 or later, Firefox ESR 140.10 or later, Thunderbird 150 or later, or Thunderbird 140.10 or later.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24111
Vulnerability details
Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
IndexedDB storage component vulnerability directly enables unauthorized local data access and sensitive information exposure (CWE-200) from the client system without authentication or interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of security-relevant patches to remediate the IndexedDB flaw before remote exploitation can occur.
Enables continuous scanning to identify systems running vulnerable Firefox/Thunderbird versions susceptible to the information-exposure issue.
Enforces approved, patched browser configurations so that only releases containing the IndexedDB fix are permitted to execute.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. via CWE-200
Ubuntu 24.04 (2 rules)
- V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. via CWE-200
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-200
Windows 10 (1 rule)
- V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. via CWE-200
Windows Server 2016 (1 rule)
- V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
Windows Server 2019 (1 rule)
- V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200
Windows Server 2022 (1 rule)
- V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-200