CVE-2026-6782
Published: 21 April 2026
Description
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and patching of software flaws like CVE-2026-6782, preventing exploitation by updating to Firefox/Thunderbird 150.
Mandates vulnerability scanning to identify unpatched instances of CVE-2026-6782 in deployed Firefox and Thunderbird installations.
Requires monitoring and distribution of security advisories such as MFSA 2026-30/33, enabling prompt awareness and remediation of CVE-2026-6782.
Security SummaryAI
CVE-2026-6782 is an information disclosure vulnerability (CWE-200) in the IP Protection component of Mozilla Firefox and Thunderbird. Published on 2026-04-21, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting high confidentiality impact with no effect on integrity or availability. The issue was fixed in Firefox version 150 and Thunderbird version 150.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges or user interaction. Successful exploitation allows disclosure of sensitive information processed by the IP Protection component.
Mozilla's security advisories MFSA 2026-30 and MFSA 2026-33, along with Bugzilla entry 2026571, provide details on the vulnerability and recommend updating to the patched versions of Firefox 150 or Thunderbird 150 for mitigation.
Details
- CWE(s)