CVE-2026-6746

Vulnerability

Overview

CVE-2026-6746 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. The issue was discovered by a team of researchers using Claude from Anthropic and reported via Bug 2014596 [1][2]. A use-after-free occurs when a program continues to use a memory reference after the memory has been freed, which can lead to a crash or potentially allow an attacker to execute arbitrary code.

Exploitation

Context

In the Firefox browser, this vulnerability could be triggered by visiting a specially crafted web page. For Thunderbird, the advisory notes that scripting is disabled when reading email, so the flaw cannot be exploited through email in the Thunderbird product. However, it remains a risk in browser or browser-like contexts [1][3].

Impact

If successfully exploited, an attacker could cause a denial of service via a crash, or potentially achieve arbitrary code execution. The vulnerability is rated High severity with a CVSS v3 score of 7.5.

Mitigation

Mozilla has fixed this vulnerability in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10 [1][2][3][4]. Users are advised to update to these versions or later to protect against potential exploitation.