CVE-2026-6749
Published: 21 April 2026
Description
Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of flaws like the uninitialized memory disclosure in Firefox's Canvas2D component via patching to fixed versions.
Mandates memory protections that specifically prevent the disclosure of uninitialized memory, directly countering the core mechanism of this CVE.
Ensures receipt, dissemination, and implementation of vendor security advisories like Mozilla's MFSA bulletins addressing this vulnerability, enabling prompt updates.
Security SummaryAI
CVE-2026-6749 is an information disclosure vulnerability caused by uninitialized memory in the Graphics: Canvas2D component of Mozilla Firefox and Thunderbird. Classified under CWE-908, it received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and was published on 2026-04-21. The flaw affects versions of Firefox prior to 150, Firefox ESR prior to 115.35 and 140.10, Thunderbird prior to 150, and Thunderbird prior to 140.10.
Remote attackers can exploit this vulnerability over the network with low attack complexity, without requiring user privileges or interaction. Exploitation enables high-impact confidentiality violations by leaking contents of uninitialized memory through the Canvas2D interface, potentially exposing sensitive data rendered or processed in the browser.
Mozilla's security advisories MFSA 2026-30, MFSA 2026-31, MFSA 2026-32, and MFSA 2026-33, along with Bugzilla entry 2022610, document the issue and confirm fixes in the specified versions. Mitigation requires updating to Firefox 150, Firefox ESR 115.35 or 140.10, Thunderbird 150, or Thunderbird 140.10.
Details
- CWE(s)