CVE-2026-6746: 
NixOS vulnerability analysis and mitigation

CVE-2026-6746 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It was discovered and reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude (Anthropic's AI model), and publicly disclosed on April 21, 2026. Affected products include Firefox before 150.0, Firefox ESR before 115.35.0, Firefox ESR 140.x before 140.10.0, Thunderbird before 150.0 (non-ESR), and Thunderbird ESR before 140.10.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The vulnerability is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), arising from improper memory management in Firefox's DOM Core & HTML component where a previously freed memory region can be accessed again (Mozilla Advisory mfsa2026-30). The attack vector is network-based with low complexity, requiring no privileges and no user interaction, suggesting the flaw can be triggered via maliciously crafted web content delivered to a vulnerable browser. The underlying bug is tracked at Mozilla Bugzilla as Bug 2014596 (access restricted). Notably, this vulnerability was discovered through AI-assisted security research using Anthropic's Claude model as part of a broader effort that uncovered 271 bugs in Firefox (Mozilla Advisory mfsa2026-30).

Successful exploitation of CVE-2026-6746 primarily impacts availability, with a high availability impact and no direct confidentiality or integrity impact per the CVSS scoring. In practice, use-after-free vulnerabilities in browser DOM components can lead to application crashes (denial of service) and, depending on exploitation sophistication, may be chained with other vulnerabilities to achieve arbitrary code execution within the browser process. Users running vulnerable versions of Firefox or Thunderbird who visit or receive malicious content are at risk, with the browser or email client being the primary affected asset (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-32).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-6746 as of the available data. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The bug was discovered through AI-assisted fuzzing/analysis rather than active exploitation, and no threat actor attribution has been identified (Mozilla Advisory mfsa2026-30).

Mozilla has released patched versions addressing CVE-2026-6746: Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these versions immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation. Enterprise deployments using Red Hat, SUSE, Debian, Oracle Linux, Rocky Linux, AlmaLinux, and Amazon Linux should apply the respective vendor-provided package updates (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The broader Firefox 150 release attracted significant media and community attention primarily due to the novel use of Anthropic's Claude AI ("Mythos" project) to discover 271 vulnerabilities, including CVE-2026-6746, in a single research effort — a landmark in AI-assisted vulnerability discovery (Mozilla Hacks Blog). Coverage from outlets including ZDNet, GBHackers, CyberSecurityNews, and CyberPress highlighted the scale of the AI-driven bug-finding campaign. Community discussions on dev.to and LinkedIn debated the implications of AI models being credited as vulnerability reporters. Mozilla published a behind-the-scenes blog post detailing the hardening effort, and CIS issued an advisory noting multiple vulnerabilities in Mozilla products could allow arbitrary code execution (CIS Advisory).