PatchGap
Firefox · Core

CVE-2026-6785

Memory Corruption in Core
High firefox Memory Corruption

Overview

High
Severity
—
CVSS
No
Exploited ITW
Embargoed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentCore
Bug ClassMemory Corruption
Tracker1935995
CISA KEVNot listed
CreditedAndrew McCreight, Ashley Zebrowski, Brian Grinstead, Christian Holler, Maurice Dauer, Tom Schuster and the Mozilla Fuzzing Team
Disclosed2026-04-21

Fix not yet public

No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.
On This Page