Cyber Posture

CVE-2026-6779

Medium

Published: 21 April 2026

Published
21 April 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0010 26.3th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-20 CWE-119

Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

addresses: CWE-20 CWE-79

Directly implements checks on information inputs to reject invalid data before processing.

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

addresses: CWE-20

Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.

addresses: CWE-119

Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

addresses: CWE-119

Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.

addresses: CWE-119

Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.

Security SummaryAI

CVE-2026-6779 is an unspecified issue in the JavaScript Engine component affecting Mozilla Firefox and Thunderbird. The vulnerability, associated with CWE-20 (Improper Input Validation), CWE-79 (Cross-site Scripting), and CWE-119 (Buffer Overflow), received a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with low confidentiality impact. It was publicly disclosed on 2026-04-21 and addressed in Firefox version 150 and Thunderbird version 150.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows limited disclosure of sensitive information without impacting integrity or availability, and the scope remains unchanged.

Mozilla's security advisories (MFSA 2026-30 and MFSA 2026-33) confirm the fix in Firefox 150 and Thunderbird 150, with additional details available in Bugzilla ticket 2023343. Security practitioners should ensure affected users upgrade to these patched versions to mitigate the risk.

Details

CWE(s)

Affected Products

mozilla
firefox
≤ 150.0
mozilla
thunderbird
≤ 150.0

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

JS engine vuln with XSS/buffer overflow enables client app exploitation and JS interpreter abuse for info disclosure.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

References