CVE-2026-6746
Published: 21 April 2026
Description
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and correction of flaws like this use-after-free vulnerability through patching to fixed Firefox and Thunderbird versions.
Implements memory protections such as ASLR and DEP that mitigate exploitation of the DOM use-after-free, reducing crash likelihood even if unpatched.
Provides denial-of-service protections to maintain browser availability against remote exploitation attempts causing crashes via this vulnerability.
Security SummaryAI
CVE-2026-6746 is a use-after-free vulnerability (CWE-416) in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It affects versions of Firefox prior to 150, Firefox ESR prior to 115.35 and 140.10, Thunderbird prior to 150 and 140.10. The issue was publicly disclosed on April 21, 2026, and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its potential for denial-of-service impact.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. Successful exploitation leads to a crash of the affected browser or mail client, resulting in high availability impact but no direct compromise of confidentiality or integrity.
Mozilla's security advisories (MFSA 2026-30 through 2026-33) and the associated Bugzilla entry (bug 2014596) detail the patch, recommending immediate upgrades to Firefox 150, Firefox ESR 115.35 or 140.10, Thunderbird 150, or Thunderbird 140.10 to mitigate the issue. No workarounds are specified in the provided references.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a use-after-free in Firefox/Thunderbird DOM leading to client crash with high availability impact and no C/I compromise, directly matching T1499.004 (Application or System Exploitation) for endpoint DoS via exploitation.