CVE-2026-6764
Description
Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Incorrect boundary conditions in the DOM: Device Interfaces component could lead to memory corruption, fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6764 is a memory safety vulnerability caused by incorrect boundary conditions in the DOM: Device Interfaces component of Mozilla products. This flaw can result in memory corruption when processing specially crafted web content.
Exploitation requires an attacker to convince a user to visit a malicious web page in a browser context where scripting is enabled. In Thunderbird, scripting is disabled when reading email, so the vulnerability is not exploitable through email messages but remains a risk in browser-like contexts (e.g., when viewing HTML content with scripting enabled) [1][3].
Successful exploitation could allow an attacker to corrupt memory, potentially leading to arbitrary code execution. The CVSS v3 base score is 6.5 (Medium), though the Mozilla advisories rate the impact as high [1][2][3][4].
The vulnerability is patched in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users are advised to update to these versions or later to mitigate the risk [1][2][3][4].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <150.0
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <140.10.0
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*Range: >=140.0,<140.10.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- www.mozilla.org/security/advisories/mfsa2026-30/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-32/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-33/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-34/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
News mentions
0No linked articles in our index yet.