CVE-2026-6767

What it actually does

CVE-2026-6767 is an information disclosure vulnerability in the NSS libraries component used by Mozilla Firefox and Mozilla Thunderbird. Based on the assigned vector, the flaw is remotely reachable over the network, requires low attack complexity, requires no privileges, and does not require user interaction. Successful exploitation can expose a limited amount of confidential data handled by the affected application or library component, without directly enabling integrity modification or service disruption.

Why it matters to the business

An attacker may be able to obtain sensitive information processed by affected Firefox or Thunderbird installations, potentially including data associated with browsing, email, or cryptographic library operations depending on the vulnerable code path. The issue has a moderate CVSS score and low EPSS score, is not listed in CISA KEV, and has no known mature public exploitation signal in the provided data, so it should be treated as a routine but important patching item rather than an emergency. Organizations with broad Firefox or Thunderbird deployment should still prioritize remediation because exposure may be widespread across endpoint fleets.

How an attack unfolds

An attacker would target a vulnerable Firefox or Thunderbird instance that uses the affected NSS library code path. Because the vulnerability is remotely reachable and does not require authentication or user interaction according to the CVSS vector, exploitation would likely involve delivering specially crafted network-accessible content, protocol data, or messages that trigger the vulnerable NSS behavior. If successful, the attacker could cause the application to disclose limited sensitive information. There is no indication from the supplied data that exploitation provides code execution, persistence, privilege escalation, or direct system compromise.

How to fix it

Upgrade affected Mozilla products to fixed versions or later. Firefox is fixed in version 150. Firefox ESR is fixed in versions 115.35 and 140.10. Thunderbird is fixed in versions 150 and 140.10. Where centralized browser or email-client management is used, push the update through the standard endpoint management, package management, or enterprise policy mechanism. If immediate patching is not possible, reduce exposure by limiting use of vulnerable versions, disabling or isolating affected applications where feasible, and ensuring endpoint protections and network monitoring remain active. Because NSS may also be packaged through operating-system distributions, verify vendor-provided Mozilla/NSS packages are current where Firefox or Thunderbird are installed from OS repositories.

How to confirm the fix worked

Confirm remediation by inventorying installed Firefox and Thunderbird versions and verifying they are at or above the fixed releases: Firefox 150, Firefox ESR 115.35 or 140.10, Thunderbird 150, or Thunderbird 140.10. On individual systems, validate through the application About dialog, about:support, package-manager output, or enterprise endpoint inventory. For managed environments, confirm update compliance through device-management reports and spot-check a representative sample of endpoints. Vulnerability scanners should no longer report the affected Mozilla Firefox or Thunderbird versions after the update is applied.

Typical attack path

1. Identify users or systems running vulnerable versions of Firefox or Thunderbird.
2. Prepare crafted network content, protocol responses, or message data intended to reach the vulnerable NSS library component.
3. Deliver the crafted data to the affected application through normal network-accessible functionality.
4. Trigger the vulnerable NSS code path without requiring authentication or explicit user interaction, according to the published CVSS characteristics.
5. Collect any information disclosed as a result of the vulnerable behavior.

How to detect it

There are no specific exploitation artifacts or public IoCs derivable from the supplied advisory details. Information disclosure through a browser or mail client library may leave little or no host-level evidence. To assess possible prior exploitation, review endpoint telemetry for unusual Firefox or Thunderbird crashes, anomalous network sessions immediately preceding crashes, suspicious inbound email content processed by Thunderbird, and proxy or DNS logs showing unexpected connections around the time vulnerable versions were in use. Correlate application version history with security telemetry to determine whether affected versions were exposed during the window after publication. If endpoint detection records memory access violations, browser crash reports, or Thunderbird parsing failures, preserve those artifacts for vendor or forensic review.

What your security team should do

• Patch Firefox and Thunderbird to the fixed versions or later across managed endpoints.
• Prioritize systems used for sensitive browsing, email handling, administrative workflows, or access to confidential data.
• Use endpoint inventory to identify unsupported, pinned, or unmanaged Firefox ESR and Thunderbird installations that may not update automatically.
• Monitor Mozilla and OS vendor advisories for any additional NSS package updates or clarification of affected downstream packages.
• Because no KEV listing, ransomware association, or mature exploit signal is provided, track this as standard vulnerability-management work unless new exploitation evidence emerges.
• Document patch compliance and create follow-up tasks for devices that remain offline or fail update deployment.