CVE-2026-6752: 
NixOS vulnerability analysis and mitigation

CVE-2026-6752 is a vulnerability caused by incorrect boundary conditions in the WebRTC component of Mozilla Firefox and Thunderbird. Reported by researcher "jmwebdevelopement" and disclosed on April 21, 2026, it affects Firefox versions prior to 150, Firefox ESR versions prior to 115.35 and 140.10, and Thunderbird ESR versions from 140.0 prior to 140.10. The vulnerability carries a CVSS v3.1 base score of 7.3 (High), assessed by CISA-ADP (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-131 (Incorrect Calculation of Buffer Size), indicating that the WebRTC component fails to properly validate or enforce memory buffer boundaries during processing. This class of flaw can allow out-of-bounds memory reads or writes when WebRTC-related operations are performed with maliciously crafted inputs. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity, meaning a remote unauthenticated attacker could potentially trigger the flaw by directing a victim's browser to process specially crafted WebRTC content. The underlying bug is tracked in Mozilla's Bugzilla as Bug 2027499, though the bug report is access-restricted (Mozilla Advisory mfsa2026-30, Feedly).

Successful exploitation of CVE-2026-6752 can result in limited but meaningful impacts across confidentiality, integrity, and availability — each rated "Low" in the CVSS assessment. An attacker could potentially read sensitive data from memory, corrupt memory contents, or cause instability in the browser or email client process. Given the WebRTC context, exploitation could occur through malicious web pages or media streams without requiring any user interaction beyond visiting a crafted site, affecting any user running a vulnerable version of Firefox or Thunderbird (Mozilla Advisory mfsa2026-30, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-6752 as of the available data. The EPSS score is approximately 0.046%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Mozilla has released patched versions addressing CVE-2026-6752: Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation. Enterprise deployments should prioritize patching Firefox ESR and Thunderbird ESR channels, as these are commonly used in managed environments (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The vulnerability was part of a broader Mozilla security release on April 21, 2026, which addressed numerous high-severity issues across Firefox and Thunderbird. Security coverage from outlets such as GBHackers and CyberPress highlighted the Firefox 150 release as fixing multiple code execution vulnerabilities. Linux distribution vendors including Red Hat, Debian, SUSE, Oracle Linux, Rocky Linux, AlmaLinux, and Amazon Linux rapidly issued downstream advisories and package updates. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-6752 has been identified beyond standard vulnerability tracking (Mozilla Advisory mfsa2026-30, Red Hat).