CVE-2026-6766

What it actually does

This vulnerability is an information disclosure flaw caused by incorrect boundary conditions in the NSS Libraries component used by Mozilla products. At a technical level, an out-of-bounds or improperly bounded read condition may allow a remote, unauthenticated attacker to cause affected software to disclose sensitive memory or protocol-related data. The CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required, with high confidentiality impact and no expected integrity or availability impact.

Why it matters to the business

Successful exploitation could expose sensitive information processed by affected Firefox or Thunderbird instances, potentially including session-related data, message contents, authentication material, or other private memory contents depending on how the vulnerable NSS code path is reached. For organizations, the main risk is loss of confidentiality rather than system takeover or service outage. Although the EPSS score is currently low and there is no known KEV listing or public exploit maturity reported, the affected products are widely deployed end-user applications, so organizations should prioritize routine but timely patching, especially on systems handling sensitive browsing, email, or administrative activity.

How an attack unfolds

An attacker would interact remotely with an affected Firefox or Thunderbird instance through a code path that uses the vulnerable NSS library component. By supplying specially crafted network, cryptographic, or protocol data that triggers the incorrect boundary condition, the attacker attempts to cause the application to read data outside the intended bounds and expose information that should remain private. Exploitation does not require authentication, privileges, or user interaction according to the CVSS vector, but practical exploitation depends on the exact vulnerable NSS behavior and reachable parsing or cryptographic workflow. There are currently no named threat actors, known ransomware use, KEV listing, or mature public exploitation signals provided for this vulnerability.

How to fix it

Upgrade affected Mozilla products to fixed releases: Firefox 150 or later, Firefox ESR 140.10 or later, Thunderbird 150 or later, and Thunderbird 140.10 or later. Where centralized software management is available, push updates across all managed endpoints and verify that ESR channels are updated separately from rapid-release channels. If immediate patching is not possible, reduce exposure by limiting use of vulnerable browsers and mail clients for sensitive workflows, disabling risky automatic content handling where operationally feasible, and ensuring systems run with least privilege. Because this is in the NSS Libraries component, also review any internally packaged or downstream software that may bundle affected Mozilla/NSS components, even if the primary named products are Firefox and Thunderbird.

How to confirm the fix worked

Confirm remediation by checking installed product versions and ensuring Firefox is at 150 or later, Firefox ESR is at 140.10 or later, Thunderbird is at 150 or later, and Thunderbird ESR is at 140.10 or later. Validate through endpoint management inventory, application self-reporting, package manager records, and vulnerability scanner plugin results once updated signatures are available. Where possible, confirm that no older parallel installations, portable application copies, or unmanaged user-installed versions remain. For Linux distributions, verify vendor package versions and changelogs because fixed NSS/Mozilla versions may be backported under distribution-specific package numbering.

Typical attack path

1. Identify users or systems running vulnerable versions of Firefox or Thunderbird that include the affected NSS Libraries component.
2. Deliver or cause the application to process specially crafted remote content, protocol data, or cryptographic input that reaches the vulnerable boundary-condition logic.
3. Trigger an unintended read or disclosure condition in the NSS component.
4. Collect leaked sensitive data from the application response, protocol behavior, crash artifact, or side channel, depending on the exploitation technique.
5. Use the disclosed information to support further compromise, session hijacking, credential theft, privacy exposure, or reconnaissance.

How to detect it

Detection of prior exploitation is difficult because information disclosure flaws often do not create clear, durable artifacts. Review endpoint detection telemetry, browser and mail-client crash reports, operating system application logs, and network security logs for abnormal Firefox or Thunderbird crashes, repeated faults in NSS-related libraries, or suspicious remote content immediately preceding crashes or anomalous outbound responses. On Windows, examine Application event logs and Windows Error Reporting entries for firefox.exe or thunderbird.exe faults involving NSS-related modules. On macOS and Linux, review crash reports, syslog/journal entries, and core dump metadata for Mozilla process crashes linked to NSS libraries. Network teams should look for unusual repeated TLS, certificate, S/MIME, or cryptographic protocol handling errors associated with Firefox or Thunderbird activity, but absence of these artifacts does not rule out exploitation. There are no provided named threat actors, KEV exploitation status, ransomware association, or public exploit indicators to anchor high-confidence IOC-based detection.

• firefox.exe
• thunderbird.exe
• nss3.dll
• libnss3.so
• libnss3.dylib
• faulting module nss3.dll
• segfault at
• core dumped
• Firefox Crash Reporter
• Thunderbird Crash Reporter
• Windows Error Reporting
• Application Error

What your security team should do

• Prioritize patch deployment for Firefox and Thunderbird installations used by privileged users, administrators, executives, help desk staff, developers, and users handling sensitive email or web sessions.
• Inventory all managed and unmanaged endpoints for vulnerable Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR versions, including portable or user-installed copies.
• Update to Firefox 150+, Firefox ESR 140.10+, Thunderbird 150+, or Thunderbird 140.10+ and verify successful rollout through endpoint telemetry or software inventory.
• Monitor vendor advisories for additional details on the affected NSS boundary condition and any later reports of exploit code or active exploitation.
• Use vulnerability management exceptions only for documented cases, with compensating controls and a defined patch deadline.
• Review EDR, crash telemetry, and browser/mail-client logs for unusual crashes or memory-safety symptoms around the time suspicious remote content was processed.