CVE-2026-6749 is an information disclosure vulnerability resulting from uninitialized memory usage in the Graphics: Canvas2D component of Mozilla Firefox. This vulnerability was identified and fixed in Firefox 150 and corresponding ESR and Thunderbird versions. The issue could allow unauthorized disclosure of information due to memory contents being exposed. The CVSS v3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Mozilla's official advisories confirm the fix in Firefox 150 and ESR 115.35 and 140.10. There are no indications of active exploitation in the wild.

Successful exploitation of this vulnerability could lead to disclosure of sensitive information from uninitialized memory in the Canvas2D graphics component. This could compromise user privacy or leak potentially sensitive data. The vulnerability does not impact integrity or availability. No known active exploits have been reported.

This vulnerability has been fixed by Mozilla in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should upgrade to these versions or later to remediate the issue. There is no indication that additional mitigation steps are required beyond applying the official updates.