CVE-2026-6747 is a use-after-free vulnerability (CWE-416) found in the WebRTC component of Mozilla Firefox. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption. This vulnerability was assigned a CVSS 3.1 base score of 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability (denial of service). Mozilla fixed this vulnerability in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. The vendor advisories (MFSA 2026-30 and MFSA 2026-32) provide detailed information on the fix and confirm the high impact rating.

The vulnerability could allow an attacker to cause a denial of service by triggering a use-after-free condition in the WebRTC component, potentially crashing the browser or causing instability. There is no direct evidence of exploitation in the wild. The impact is rated high due to the potential for memory corruption affecting availability.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisories. No additional mitigation actions are indicated beyond applying the official updates.