Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

The core impact of CVE-2026-6785 stems from its memory corruption nature. Successful exploitation could allow an attacker to overwrite critical memory regions within the Firefox or Thunderbird process, potentially leading to arbitrary code execution. This means an attacker could gain control of the affected system, execute malicious commands, steal sensitive data (such as browsing history, saved passwords, and personal information), or install malware. The severity is heightened by the potential for remote exploitation, as an attacker could potentially trigger the vulnerability through crafted web content or malicious emails. While the description notes that exploitation would require “enough effort,” the presence of memory corruption bugs is a significant security concern, especially given the widespread use of Firefox and Thunderbird.

Users of legacy Firefox ESR deployments, particularly those running versions 115.34 through 140.9, are at heightened risk. Organizations relying on older Thunderbird versions (140.9/150) and those with strict change management processes that delay patching are also vulnerable. Shared hosting environments where users have limited control over software updates should prioritize patching.

• firefox: Check Firefox version using about:support in the browser. Ensure it's at least version 150 or the appropriate ESR version. • linux / server: Monitor system logs (e.g., /var/log/syslog, /var/log/messages) for Firefox or Thunderbird crashes or unexpected behavior. • generic web: Monitor web server access logs for requests to potentially malicious URLs that could trigger the vulnerability.

# Example: Check Firefox version using curl
curl -s -I http://localhost:8080/about:support | grep "Firefox/"

1. 2026-04-21Disclosure

   disclosure

1. Gereserveerd2026-04-21
2. Gepubliceerd2026-04-21
3. Gewijzigd2026-04-22
4. EPSS bijgewerkt2026-04-29

The primary mitigation for CVE-2026-6785 is to immediately upgrade to a patched version of Firefox or Thunderbird. Specifically, upgrade to Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, or Thunderbird 140.10. If an immediate upgrade is not feasible due to compatibility issues or system downtime requirements, consider implementing temporary workarounds. While no specific WAF or proxy rules are mentioned, restricting access to untrusted websites and carefully scrutinizing downloaded files can help reduce the attack surface. Monitor system logs for unusual activity or crashes that might indicate exploitation attempts. After upgrading, confirm the fix by attempting to reproduce the vulnerability using known exploit techniques (if available) or by verifying the version number of the installed software.