CVE-2026-6780: 
NixOS vulnerability analysis and mitigation

CVE-2026-6780 is a denial-of-service vulnerability in the Audio/Video: Playback component of Mozilla Firefox and Thunderbird. It was reported by researcher "LatticeBased" and disclosed on April 21, 2026, as part of Mozilla Foundation Security Advisory 2026-30. The vulnerability affects all versions of Firefox and Thunderbird prior to 150.0. Mozilla rated its impact as low, while CISA-ADP assigned a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory, Github Advisory).

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the Audio/Video Playback component fails to properly limit resource allocation during media processing (Github Advisory). An unauthenticated remote attacker can trigger the flaw over the network with low attack complexity and no user interaction required, potentially by supplying specially crafted audio or video content that causes excessive resource consumption. No public proof-of-concept code or detailed technical write-up is currently available, as the underlying Bugzilla report (Bug 2025179) requires permissions to access (Mozilla Advisory).

Successful exploitation results in a denial-of-service condition, causing the affected Firefox or Thunderbird application to become unresponsive or crash. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability of the affected client application. Because this is a client-side browser/email client vulnerability, the scope is confined to the individual user's session and does not directly enable lateral movement or data exfiltration (Github Advisory, Mozilla Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-6780. The EPSS score is approximately 0.038–0.057%, placing it in a low exploitation probability range (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

Mozilla has released fixed versions addressing this vulnerability: Firefox 150 and Thunderbird 150. Users and administrators should update to these versions or later immediately. No configuration-based workaround has been published; upgrading is the only recommended remediation (Mozilla Advisory, Mozilla Thunderbird Advisory).

The CIS (Center for Internet Security) published an advisory noting multiple vulnerabilities in Mozilla products fixed in Firefox 150, including CVE-2026-6780, and flagged the broader release as addressing potential arbitrary code execution risks. Security news outlets including GBHackers and CyberPress covered the Firefox 150 release, focusing primarily on the higher-severity memory safety and use-after-free bugs rather than this specific low-impact DoS issue. No notable individual researcher commentary specific to CVE-2026-6780 has been identified beyond the initial disclosure.