CVE-2026-6770

Received Received - Intake

IndexedDB Vulnerability in Firefox 150 Allows Data Corruption

Publication date: 2026-04-21

Last updated on: 2026-04-22

Assigner: Mozilla Corporation

Description

Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-21

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-6770

EUVD

EUVD-2026-24111

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 150.0 (exc)
mozilla	firefox	to 140.10.0 (exc)
mozilla	thunderbird	to 140.10.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Impact Analysis

This vulnerability in the Storage: IndexedDB component of Firefox could lead to a low impact on confidentiality and availability, as indicated by the CVSS score. An attacker could potentially exploit this issue remotely without user interaction, causing limited data disclosure and partial disruption of service.

Executive Summary

This vulnerability is an issue in the Storage: IndexedDB component of Mozilla Firefox. It was addressed and fixed in Firefox version 150 and Firefox ESR 140.10.

Mitigation Strategies

To mitigate this vulnerability, update your Firefox browser to version 150 or later, or Firefox ESR to version 140.10 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-6770. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70