CVE-2026-6746 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. This memory safety bug allows for potential memory corruption, which could lead to denial of service or other impacts. The issue was reported by multiple researchers and fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability. Mozilla has published official security advisories confirming the fix.

The vulnerability can cause a denial of service (high impact on availability) due to use-after-free memory corruption in the DOM: Core & HTML component. There is no direct confidentiality or integrity impact reported. No known exploits in the wild have been documented, but the potential for exploitation exists given the nature of use-after-free bugs.

This vulnerability is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these versions or later to remediate the issue. Mozilla manages remediation for these products via official updates. Patch status is confirmed by Mozilla security advisories mfsa2026-30 and mfsa2026-31. No additional mitigation steps are required beyond applying the official updates.