VYPR
← All advisories
High severity7.5NVD Advisory· Published Apr 21, 2026· Updated Apr 22, 2026

CVE-2026-6758

CVE-2026-6758

Description

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2026-6758 is a use-after-free vulnerability in Firefox's WebAssembly component, fixed in Firefox 150 and Thunderbird 150, with a high severity CVSS score of 7.5.

CVE-2026-6758 is a use-after-free vulnerability in the WebAssembly component of the JavaScript engine, affecting Firefox and Thunderbird. This memory safety bug occurs when the engine does not properly manage object lifetimes during WebAssembly compilation or execution, leading to a dangling pointer that can be dereferenced by an attacker [1][2].

To exploit this vulnerability, an attacker would need to craft a malicious web page or WebAssembly module that triggers the use-after-free condition. No additional privileges are required beyond convincing the victim to visit the crafted content in a browser context. However, in Thunderbird, scripting is disabled when reading mail, which mitigates the risk for email-based attacks, but the flaw remains exploitable in browser-like contexts within Thunderbird or Firefox [1].

Successful exploitation could allow an attacker to execute arbitrary code or cause a denial of service, as use-after-free bugs often permit memory corruption that can be leveraged for code execution. The vulnerability was assigned a high severity rating under CVSS v3 with a score of 7.5 [1][2].

The vulnerability was fixed in Firefox 150 and Thunderbird 150, released on April 21, 2026. Mozilla credits the discovery to researchers Evyatar Ben Asher, Keane Lucas, and others who used Claude from Anthropic for fuzzing assistance. Users are advised to update to the latest versions to mitigate the risk [1][2].

References
  1. Security Vulnerabilities fixed in Thunderbird 150
  2. Security Vulnerabilities fixed in Firefox 150

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

4

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

50