CVE-2026-6773: 
NixOS vulnerability analysis and mitigation

CVE-2026-6773 is a denial-of-service vulnerability caused by an integer overflow in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. Reported by Richard Belisle, it was disclosed on April 21, 2026, and affects all versions of Firefox and Thunderbird prior to 150.0. Mozilla rated the impact as low in its advisory, while CISA-ADP assigned a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory, Github Advisory).

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound), occurring within Firefox's and Thunderbird's WebGPU graphics subsystem. An integer value in the WebGPU component can overflow or wrap around during a calculation, leading to an unexpected program state that causes a denial of service. Because the attack vector is network-based with no authentication or user interaction required (per the CISA-ADP CVSS assessment), a remote attacker could potentially trigger the condition by delivering crafted WebGPU content. The underlying bug is tracked as Mozilla Bug 2015959, though the Bugzilla entry requires permissions to view (Mozilla Advisory, Github Advisory).

Successful exploitation results in a denial-of-service condition, crashing or hanging the affected Firefox or Thunderbird application. There is no assessed impact on confidentiality or data integrity — the vulnerability is limited to availability. Users running vulnerable versions of Firefox or Thunderbird (all versions before 150.0) are at risk of application disruption when processing malicious WebGPU content (Mozilla Advisory, Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-6773. The EPSS score is approximately 0.038–0.057%, placing it in the 18th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Github Advisory, Feedly).

Mozilla has addressed this vulnerability in Firefox 150 and Thunderbird 150, released on April 21, 2026. Users should update to these versions or later immediately. No configuration-based workaround has been published; upgrading is the only recommended remediation. Organizations that cannot update immediately should consider disabling WebGPU functionality if their deployment environment supports such configuration (Mozilla Advisory, Mozilla Thunderbird Advisory).

The CIS issued an advisory noting multiple vulnerabilities in Mozilla products fixed in Firefox 150, including CVE-2026-6773, framing the broader release as addressing potential arbitrary code execution risks. Security news outlets such as GBHackers and CyberPress covered the Firefox 150 release highlighting the batch of fixes. No significant individual researcher commentary specific to CVE-2026-6773 has been identified, consistent with its low-severity classification by Mozilla.