CVE-2026-6747
Description
Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Use-after-free in Mozilla's WebRTC component could allow an attacker to execute arbitrary code in a browser or browser-like context.
Vulnerability
CVE-2026-6747 is a use-after-free vulnerability in the WebRTC component of Mozilla Firefox and Thunderbird. The bug, reported by Nan Wang, occurs when a previously freed memory object is accessed, leading to potentially exploitable memory corruption [1][2].
Exploitation
An attacker could trigger this vulnerability by convincing a user to visit a specially crafted web page or interact with WebRTC content in a browser-like context. In Thunderbird, scripting is disabled when reading email, so the flaw cannot be exploited through email alone; however, it remains a risk in browser or browser-like contexts [1][3].
Impact
Successful exploitation could allow an attacker to execute arbitrary code in the context of the affected application, potentially leading to system compromise. The vulnerability is rated High with a CVSS v3 score of 7.5.
Mitigation
Mozilla addressed CVE-2026-6747 in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10, all released on April 21, 2026 [1][2][3][4]. Users should update to these versions or later to mitigate the risk.
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <150.0
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <140.10.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- www.mozilla.org/security/advisories/mfsa2026-30/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-32/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-33/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-34/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
News mentions
0No linked articles in our index yet.