CVE-2026-6772: 
NixOS vulnerability analysis and mitigation

CVE-2026-6772 is a vulnerability involving incorrect boundary conditions in the Libraries component of Mozilla's Network Security Services (NSS). Reported by researcher sseehra and disclosed on April 21, 2026, it affects Firefox prior to version 150, Firefox ESR prior to 115.35 and 140.10, Thunderbird prior to 150, and Thunderbird ESR prior to 140.10. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-787 (Out-of-bounds Write), rooted in incorrect boundary condition handling within Mozilla's NSS (Network Security Services) library. NSS is a cryptographic library used by Firefox and Thunderbird for TLS/SSL and other security operations, meaning the flaw resides in a security-critical code path. The vulnerability is exploitable remotely without authentication or user interaction (network-based attack vector, low complexity), suggesting it may be triggerable through crafted network traffic or content processed by the NSS library. The underlying bug is tracked at Mozilla Bugzilla as Bug 2026089, though the bug report requires permissions to access (Mozilla Advisory mfsa2026-30, GitHub Advisory).

The primary impact of CVE-2026-6772 is a high confidentiality impact with no integrity or availability impact, as reflected in the CVSS vector (C:H/I:N/A:N). Successful exploitation could allow a remote, unauthenticated attacker to read sensitive memory contents from the NSS library, potentially exposing cryptographic material, session tokens, or other sensitive data processed during TLS/SSL operations. Given NSS's role in handling encrypted communications in Firefox and Thunderbird, exploitation could undermine the confidentiality of secure browsing sessions or email communications (Mozilla Advisory mfsa2026-31, GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-6772 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. The vulnerability is detectable by multiple commercial scanners including Nessus and Qualys (Feedly).

Mozilla has released patched versions addressing CVE-2026-6772: Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. Users and administrators should update to these versions immediately. Downstream Linux distributions including Red Hat, Debian, SUSE, Oracle Linux, Rocky Linux, AlmaLinux, and Amazon Linux 2 have also released updated packages. No configuration-based workaround is available; upgrading to a fixed version is the only recommended remediation (Mozilla Advisory mfsa2026-30, Mozilla Advisory mfsa2026-31, Mozilla Advisory mfsa2026-32).

The vulnerability was covered as part of broader reporting on the Firefox 150 release, which addressed numerous security issues. Security news outlets including GBHackers and CyberPress covered the Firefox 150 release highlighting multiple code execution vulnerability fixes. CIS issued an advisory noting multiple vulnerabilities in Mozilla products could allow for arbitrary code execution. Community discussion was limited, consistent with the moderate severity rating and lack of active exploitation (CIS Advisory).