CVE-2026-6772

What it actually does

CVE-2026-6772 is an information disclosure vulnerability caused by incorrect boundary-condition handling in the Mozilla Network Security Services library component used by Firefox and Thunderbird. A remote, unauthenticated attacker could cause affected software to process specially crafted input in a way that reads or exposes data outside the intended bounds. The primary impact is confidentiality loss: sensitive memory contents, session-related data, message or browsing context, or other process-resident information may be exposed. The vulnerability is not described as enabling code execution, privilege escalation, or direct data modification.

Why it matters to the business

Successful exploitation could expose sensitive information handled by affected browsers or mail clients, potentially including user data, authentication material, email content, browsing-related data, or other confidential process memory. For organizations, this can increase the risk of credential theft, privacy incidents, regulatory exposure, and follow-on compromise if leaked information is useful to an attacker. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS probability, and has no reported public exploit maturity, but the CVSS score is high for confidentiality impact and affected software is widely deployed on endpoints, so remediation should be handled through normal urgent browser and mail-client patching cycles.

How an attack unfolds

An attacker would first identify users or systems running vulnerable versions of Firefox, Firefox ESR, Thunderbird, or software paths that rely on the affected NSS library. The attacker would then deliver crafted network, web, certificate, cryptographic, or message-related content that causes the vulnerable NSS boundary logic to be exercised. If processing succeeds, the vulnerable application may disclose memory or security-sensitive data to the attacker-controlled context. The attacker can then use any exposed secrets, tokens, message content, or environmental information to support phishing, account takeover, lateral movement, or additional exploitation. There is no indication from the provided data that this vulnerability is currently exploited in the wild or associated with a named threat actor campaign.

How to fix it

Upgrade affected Mozilla products to fixed versions or later: Firefox 150 or later, Firefox ESR 115.35 or later, Firefox ESR 140.10 or later, Thunderbird 150 or later, and Thunderbird 140.10 or later. Ensure endpoint management, software inventory, and package-management tooling update all installed channels, including ESR deployments and portable or user-installed copies. Where immediate upgrade is not possible, reduce exposure by limiting use of affected applications for untrusted web or email content, disabling automatic processing of risky remote content where feasible, and prioritizing isolation for high-risk users until updates are applied. Because the vulnerable component is NSS, also review systems that bundle Mozilla NSS libraries indirectly and update dependent packages when vendor fixes are available.

How to confirm the fix worked

Confirm that all deployed Firefox and Thunderbird installations report fixed versions or later: Firefox 150+, Firefox ESR 115.35+ or 140.10+, Thunderbird 150+, or Thunderbird 140.10+. Validate through enterprise software inventory, endpoint detection tooling, package-manager queries, and direct application version checks. On Linux and other platforms where NSS may be packaged separately, verify the installed NSS package has received the vendor security update corresponding to this fix. Confirm that no vulnerable ESR or non-ESR release channels remain in use, including user-profile installations, unmanaged endpoints, VDI images, gold images, and offline systems. After patch deployment, spot-check that applications successfully launch and that update policies prevent rollback to vulnerable versions.

Typical attack path

1. Identify targets likely running vulnerable Mozilla Firefox, Firefox ESR, Thunderbird, or NSS-dependent application versions.
2. Deliver attacker-controlled content that is parsed or validated through the vulnerable NSS Libraries component.
3. Trigger the incorrect boundary-condition path during parsing or cryptographic/security processing.
4. Cause unintended disclosure of data from the affected process or security context.
5. Use any exposed information, such as session material, user data, or contextual details, to support follow-on compromise.

How to detect it

There are no reliable, vulnerability-specific indicators in the provided data that prove exploitation occurred. Because this is an information disclosure issue in a client-side library component, successful exploitation may not create obvious logs or persistent artifacts. Security teams should review endpoint telemetry, browser and mail-client crash reports, EDR events, and operating-system application logs for unusual or repeated crashes involving Firefox, Thunderbird, or NSS libraries around suspicious web or email activity. Useful sources include browser crash telemetry, Thunderbird error reports, endpoint process and module-load telemetry, proxy and DNS logs for unusual attacker-controlled destinations, mail gateway logs for suspicious messages or remote content, and EDR memory-access or exploit-detection alerts. Investigations should correlate vulnerable application versions, suspicious inbound email or web sessions, unexpected application crashes, and subsequent credential or session misuse. Absence of such evidence does not rule out exploitation, because information disclosure may be silent.

What your security team should do

• Prioritize patch deployment for Firefox and Thunderbird across managed endpoints, with special focus on users who handle sensitive data, email-heavy workflows, or high-risk web browsing.
• Use software inventory to identify vulnerable Firefox, Firefox ESR, Thunderbird, and NSS library versions, including unmanaged or user-installed copies.
• Patch to Firefox 150+, Firefox ESR 115.35+ or 140.10+, Thunderbird 150+, or Thunderbird 140.10+ as appropriate for the release channel.
• Monitor vendor advisories for any change in exploit maturity, KEV status, or additional NSS-dependent product fixes.
• Where patching is delayed, restrict exposure to untrusted web and email content and consider temporary isolation for high-risk users.
• Review endpoint crash telemetry and browser/mail-client anomaly reports for suspicious crashes or repeated faults in NSS-related libraries, while recognizing that exploitation may leave limited forensic evidence.