CVE-2026-6781: 
NixOS vulnerability analysis and mitigation

CVE-2026-6781 is a denial-of-service vulnerability in the Audio/Video: Playback component of Mozilla Firefox and Thunderbird. Reported by researcher "LatticeBased" and disclosed on April 21, 2026, it affects all versions of Firefox and Thunderbird prior to 150.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP, with no confidentiality or integrity impact but high availability impact (Mozilla Advisory, Github Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the Audio/Video Playback component fails to properly limit resource allocation when processing certain media content (Github Advisory). The vulnerability is exploitable remotely over the network with low attack complexity, requiring no privileges and no user interaction, suggesting that a maliciously crafted media resource served to a vulnerable browser or email client could trigger the condition. The underlying Mozilla bug report is tracked at Bugzilla bug 2025583, though the bug details are access-restricted (Mozilla Advisory).

Successful exploitation causes a denial-of-service condition in the affected Firefox or Thunderbird application, resulting in high availability impact with no confidentiality or integrity loss. An attacker could cause the browser or email client to become unresponsive or crash by delivering specially crafted audio/video content, disrupting the end user's session. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Github Advisory, Mozilla Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-6781. The EPSS score is approximately 0.038–0.057%, placing it in a low exploitation probability range (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

Mozilla has released fixed versions addressing this vulnerability: Firefox 150 and Thunderbird 150. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation (Mozilla Advisory, Mozilla Thunderbird Advisory).

The CIS published an advisory noting multiple vulnerabilities in Mozilla products fixed in this release cycle, including CVE-2026-6781, framing the broader Firefox 150 update as addressing risks up to arbitrary code execution. Security news outlets including GBHackers and CyberPress covered the Firefox 150 release, highlighting the range of fixes. No notable individual researcher commentary specific to CVE-2026-6781 has been identified, consistent with its low-impact classification within the broader advisory.