CVE-2026-6785highCWE-125CWE-416CWE-787

CVE-2026-6785: high-severity vulnerability in Mozilla Firefox

Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Published · Updated

Follow this CVE+ Monitor Firefox+ Monitor Thunderbird

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert.

ssvc Trackcvss 7.5epss 0.5%
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · RECOMENDAÇÃO 08/2026Recomendações de Segurança Cibernética – Atualização para a versão 150 do Mozila Firefoxread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Mozilla · FirefoxMozilla · Thunderbird
Related CVEs — Mozilla Firefox

In the same product, most dangerous first.

CVE-2016-9079HIGHCVE-2016-9079EPSS 87.4%KEVCVE-2019-11708CRITICALCVE-2019-11708EPSS 55.9%KEVCVE-2019-17026HIGHCVE-2019-17026EPSS 46.3%KEVCVE-2019-11707HIGHCVE-2019-11707EPSS 38.0%KEVCVE-2024-9680CRITICALCVE-2024-9680EPSS 23.2%KEVCVE-2022-26485HIGHCVE-2022-26485EPSS 14.3%KEV