CVE-2026-6758: 
NixOS vulnerability analysis and mitigation

CVE-2026-6758 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird. It was discovered and disclosed on April 21, 2026, as part of Mozilla Foundation Security Advisory 2026-30. The vulnerability affects Firefox versions prior to 150.0 and Thunderbird versions prior to 150.0. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Mozilla Advisory, Github Advisory).

The vulnerability is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), occurring within Firefox's JavaScript engine WebAssembly component. A use-after-free condition arises when memory that has been freed is subsequently referenced or reused, potentially allowing an attacker to influence program execution by controlling the reallocated memory region. The bug was identified as Bug 2013619 in Mozilla's Bugzilla tracker and was discovered by a team of researchers — Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger — using Claude from Anthropic as part of Mozilla's AI-assisted security research initiative (Mozilla Advisory, Github Advisory).

The primary impact of this vulnerability is on availability, as the CVSS assessment indicates high availability impact with no confidentiality or integrity impact. Successful exploitation could cause a crash or denial-of-service condition in the affected Firefox or Thunderbird process. In more severe scenarios typical of use-after-free vulnerabilities, an attacker may be able to achieve arbitrary code execution within the browser's process context, though Mozilla rated this specific CVE as "moderate" impact in their advisory (Mozilla Advisory, Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-6758. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038–0.057%, placing it in a low exploitation probability range (Github Advisory). The bug was discovered through AI-assisted security research rather than active exploitation, and the Bugzilla entry requires permissions to view, suggesting no public technical details have been released.

Mozilla has released fixed versions addressing this vulnerability: Firefox 150 and Thunderbird 150. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation (Mozilla Advisory, Mozilla Thunderbird Advisory).

The broader Firefox 150 release attracted significant media attention due to Mozilla's use of AI models — specifically Anthropic's Claude via the "Mythos" framework — to discover 271 vulnerabilities, including CVE-2026-6758. Coverage appeared across outlets including ZDNet, GBHackers, CyberPress, and CyberSecurityNews, framing the release as a landmark in AI-assisted vulnerability research (GBHackers, ZDNet). Mozilla published a behind-the-scenes blog post on the Hacks blog detailing the hardening process (Mozilla Hacks). The CIS also issued an advisory noting multiple vulnerabilities in Mozilla products could allow for arbitrary code execution.