CVE-2026-6782
Published: 21 April 2026
Summary
CVE-2026-6782 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 12.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and patching of software flaws like CVE-2026-6782, preventing exploitation by updating to Firefox/Thunderbird 150.
Mandates vulnerability scanning to identify unpatched instances of CVE-2026-6782 in deployed Firefox and Thunderbird installations.
Requires monitoring and distribution of security advisories such as MFSA 2026-30/33, enabling prompt awareness and remediation of CVE-2026-6782.
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.NVD Description
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
Deeper analysisAI
CVE-2026-6782 is an information disclosure vulnerability (CWE-200) in the IP Protection component of Mozilla Firefox and Thunderbird. Published on 2026-04-21, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting high confidentiality impact with no effect on integrity or availability. The issue was fixed in Firefox version 150 and Thunderbird version 150.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges or user interaction. Successful exploitation allows disclosure of sensitive information processed by the IP Protection component.
Mozilla's security advisories MFSA 2026-30 and MFSA 2026-33, along with Bugzilla entry 2026571, provide details on the vulnerability and recommend updating to the patched versions of Firefox 150 or Thunderbird 150 for mitigation.
Details
- CWE(s)