CVE-2026-6746: Use-After-Free in Firefox Core & HTML Component

A use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. In the context of Firefox, this could allow an attacker to craft a malicious web page that, when visited by a user, triggers the vulnerability. Successful exploitation could lead to a denial-of-service (DoS) by crashing the browser, or, more seriously, allow the attacker to execute arbitrary code within the context of the user's browser session. This could enable the attacker to steal sensitive data, install malware, or take control of the user's system. The impact is amplified if the user has elevated privileges or access to sensitive information.

1. Reserved2026-04-21
2. Published2026-04-21
3. Modified2026-04-22
4. EPSS updated2026-04-29

The primary mitigation for CVE-2026-6746 is to upgrade to a patched version of Firefox or Thunderbird. Specifically, upgrade to Firefox 150.0.0 or later, Firefox ESR 115.35 or later, Firefox ESR 140.10 or later, Thunderbird 150 or later, or Thunderbird 140.10 or later. If immediate upgrading is not possible, consider implementing stricter content security policies (CSP) to limit the potential attack surface. While not a direct fix, CSP can restrict the resources a page can load, potentially hindering exploitation. Monitor network traffic for unusual patterns or connections that might indicate exploitation attempts. After upgrading, confirm the fix by visiting a known safe website and verifying that the browser version reflects the patched version.