CVE-2026-6784
Published: 21 April 2026
Summary
CVE-2026-6784 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 21.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-6784 involves multiple memory safety bugs in Firefox version 149 and Thunderbird version 149, classified under CWE-125 (Out-of-bounds Read), CWE-416 (Use After Free), and CWE-787 (Out-of-bounds Write). Some of these bugs exhibited evidence of memory corruption, which Mozilla presumes could be exploited with sufficient effort to achieve arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 7.5.
A remote attacker with no privileges required can exploit this over the network, though it demands high attack complexity and user interaction, such as clicking a malicious link or opening a crafted webpage or email. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution within the affected browser or email client context.
Mozilla's security advisories (MFSA 2026-30 and MFSA 2026-33) detail the fixes applied in Firefox 150 and Thunderbird 150, recommending immediate updates to mitigate the issues. Additional technical details are available in the associated Bugzilla entries.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24125
Vulnerability details
Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was…
more
fixed in Firefox 150 and Thunderbird 150.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes memory corruption vulnerabilities in client applications (Firefox/Thunderbird) enabling arbitrary code execution via malicious webpage or email content. This directly maps to T1203 (Exploitation for Client Execution) as the core exploitation vector and T1204.001 (Malicious Link) due to the required user interaction of clicking a crafted link or opening malicious content.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates identification, reporting, and timely patching of system flaws like the memory safety bugs in Firefox 149, fixed in version 150.
Implements security safeguards such as ASLR, DEP, and stack canaries to protect against unauthorized code execution from memory corruption vulnerabilities like out-of-bounds reads/writes and use-after-free.
Enables vulnerability scanning to identify systems running vulnerable Firefox 149 or Thunderbird 149 versions exploitable for arbitrary code execution.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 8 (1 rule)
- V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416
RHEL 9 (1 rule)
- V-257794 RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. via CWE-416