CVE-2026-6755

CVE-2026-6755 is a mitigation bypass vulnerability in the DOM postMessage component of Firefox and Thunderbird [1][2]. The exact root cause is not disclosed, but it allows an attacker to circumvent security restrictions enforced by the postMessage API.

Exploitation requires a browser or browser-like context. In Thunderbird, scripting is disabled when reading mail, so the vulnerability cannot be exploited via email directly; however, it remains a risk in other contexts where scripts can execute [1][2].

A successful attack could bypass security mitigations, potentially enabling further exploitation such as cross-origin attacks or privilege escalation. The impact is rated medium with a CVSS score of 6.5.

The vulnerability is fixed in Firefox 150 and Thunderbird 150 [1][2]. Users should update to the latest versions to mitigate the risk.