CVE-2026-6746

Modified Modified - Updated After Analysis

Use-After-Free in Firefox DOM Core & HTML Components

Publication date: 2026-04-21

Last updated on: 2026-06-30

Assigner: Mozilla Corporation

Description

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-21

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-04-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-6746

EUVD

EUVD-2026-24087

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 150.0 (exc)
mozilla	firefox	to 115.35.0 (exc)
mozilla	firefox	From 140.0 (inc) to 140.10.0 (exc)
mozilla	thunderbird	to 140.10.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-825	The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2026-6746 is a high-impact use-after-free vulnerability located in the DOM: Core & HTML component of Firefox and Firefox ESR.

A use-after-free bug occurs when a program continues to use a pointer after the memory it points to has been freed, which can lead to memory corruption and exploitation.

This vulnerability was reported by multiple researchers and fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10 as part of broader security updates.

Impact Analysis

This use-after-free vulnerability can lead to memory corruption, crashes, and potentially arbitrary code execution.

Exploitation of this vulnerability could allow attackers to execute malicious code within the context of the affected Firefox browser, compromising system security.

The vulnerability affects the security posture of Firefox by exposing it to risks such as privilege escalation, information disclosure, and other security breaches.

Mitigation Strategies

To mitigate the CVE-2026-6746 vulnerability, you should update your Firefox or Firefox ESR browser to the fixed versions.

Upgrade Firefox to version 150 or later.
Upgrade Firefox ESR to version 115.35 or later.
Upgrade Firefox ESR to version 140.10 or later.

These updates include fixes for the use-after-free vulnerability in the DOM: Core & HTML component, along with other security improvements that enhance memory safety and prevent potential arbitrary code execution.

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-6746 on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-6746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70