CVE-2026-6754: 
NixOS vulnerability analysis and mitigation

CVE-2026-6754 is a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox and Thunderbird. Discovered and reported by Xuehao Guo, it was publicly disclosed on April 21, 2026, alongside a broad set of security fixes in Mozilla's April 2026 security advisories. Affected products include Firefox prior to 150.0, Firefox ESR prior to 115.35.0, Firefox ESR 140.x prior to 140.10.0, Thunderbird prior to 150, and Thunderbird ESR prior to 140.10. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The vulnerability is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), rooted in improper memory management within Firefox's JavaScript Engine component (Feedly). A use-after-free occurs when the engine accesses memory that has already been freed, potentially allowing an attacker to control the freed memory region and influence program execution. The attack vector is network-based, requires no authentication, no user interaction, and no special privileges, making it exploitable remotely by any party who can deliver malicious JavaScript content to a vulnerable browser or email client. The underlying bug is tracked at Mozilla Bugzilla as Bug 2027541 (Mozilla Bugzilla).

Successful exploitation of CVE-2026-6754 primarily impacts availability, with the CVSS assessment indicating a high availability impact and no direct confidentiality or integrity impact under the scored vector. In practice, use-after-free vulnerabilities in JavaScript engines can lead to application crashes (denial of service) and, depending on heap layout control, may be chained with other vulnerabilities to achieve arbitrary code execution within the browser process. Given the wide deployment of Firefox and Thunderbird across enterprise and consumer environments, exploitation could affect a large number of end users if delivered via malicious web content or email (Mozilla Advisory mfsa2026-30, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-6754 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the wild (Feedly). The vulnerability is detectable by multiple vulnerability scanners including Nessus and Qualys, and patches have been broadly distributed across Linux distributions (Red Hat, Debian, SUSE, Oracle, Rocky Linux, AlmaLinux, Amazon Linux) and other platforms.

Mozilla has released patched versions addressing CVE-2026-6754: Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. Users and administrators should update to these versions or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize patching browser and email client deployments, particularly in environments where users may encounter untrusted web content or email attachments (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

Mozilla issued coordinated security advisories (mfsa2026-30 through mfsa2026-34) on April 21, 2026, covering CVE-2026-6754 alongside numerous other vulnerabilities fixed in the same release cycle. The CIS published an advisory noting that multiple vulnerabilities in Mozilla products could allow for arbitrary code execution (CIS Advisory). Major Linux distributions including Red Hat, Debian, SUSE, Oracle Linux, Rocky Linux, AlmaLinux, and Amazon Linux rapidly issued updated packages. Security news outlets such as GBHackers and CyberPress covered the Firefox 150 release highlighting the security fixes (GBHackers).