CVE-2026-6769

CVE-2026-6769 is a privilege escalation vulnerability in the Debugger component affecting Mozilla Firefox versions prior to 150, Firefox ESR prior to 140.10, Thunderbird prior to 150, and Thunderbird prior to 140.10. Assigned CWE-269 (Improper Privilege Management), it received a CVSS v3.1 base score of 8.8 (High), reflecting network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), user interaction (UI:R), unchanged scope (S:U), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The issue was publicly disclosed on 2026-04-21.

An attacker can exploit this vulnerability remotely without authentication by tricking a user into performing an action, such as interacting with a malicious webpage or debugger feature. Successful exploitation enables privilege escalation, potentially allowing the attacker to gain high-level access within the affected application, resulting in unauthorized data access, modification, or denial of service.

Mozilla's security advisories (MFSA 2026-30, 32, 33, 34) and the associated Bugzilla entry (bug 2023753) confirm the vulnerability was addressed in the specified fixed releases: Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Security practitioners should prioritize updating affected products to these versions or later to mitigate the risk.