CVE-2026-6747 is a use-after-free vulnerability identified in the WebRTC component of Mozilla Firefox. Use-after-free issues occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption or crashes. This vulnerability was fixed in Firefox 150 and Firefox ESR 140.10. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability (denial of service). The vendor advisories confirm the fix and provide references to the underlying bugs. No known exploits in the wild have been reported at the time of publication.

The vulnerability can lead to denial of service (application crash or instability) due to use-after-free in the WebRTC component. While no direct evidence of code execution or data confidentiality/integrity impact is stated, memory corruption issues of this type can potentially be leveraged for more severe attacks. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability. No known active exploitation has been reported.

Mozilla has released official fixes for this vulnerability in Firefox 150 and Firefox ESR 140.10. Users and administrators should update affected Firefox versions to 150 or later, or Firefox ESR 140.10 or later, to remediate this issue. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated by the vendor advisories.