CVE-2026-6763
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Apr 21, 2026
CISA due date
—
The record
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 150.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.9.1-1.1 |
Related vulnerabilities
- CVE-2026-12323 Spoofing issue in the DOM: Core & HTML component. Also affects MozillaFirefox
- CVE-2026-12324 Incorrect boundary conditions in the Graphics: CanvasWebGL component. Also affects MozillaFirefox
- CVE-2026-12325 Denial-of-service in the Graphics: ImageLib component. Also affects MozillaFirefox
- CVE-2026-12327 Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and… Also affects MozillaFirefox
- CVE-2026-12326 Memory safety bugs present in Firefox 151 and Thunderbird 151. Also affects MozillaFirefox
- CVE-2026-12328 Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR… Also affects MozillaFirefox
- CVE-2026-12318 Incorrect boundary conditions in the Libraries component in NSS. Also affects MozillaFirefox
- CVE-2026-12319 Denial-of-service in the Audio/Video: Playback component. Also affects MozillaFirefox