CVE-2026-4712 is an information disclosure vulnerability affecting the Widget: Cocoa component in Mozilla Firefox. The vulnerability allows unauthorized information disclosure and is classified under CWE-200. It has a CVSS 3.1 score of 7.5 (high severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Mozilla fixed this vulnerability in Firefox 149 and Firefox ESR 140.9. The vendor advisory confirms the fix and provides references to the bug report (Bug 2017666). There are no known active exploits targeting this vulnerability.

The vulnerability could lead to unauthorized disclosure of information from the Widget: Cocoa component in Firefox, potentially exposing sensitive data. However, there is no indication of integrity or availability impact. No known exploits in the wild have been reported, reducing immediate risk. The high CVSS score reflects the potential impact of information disclosure over a network without user interaction or privileges.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official update.