CVE-2026-6749 is a high-severity information disclosure vulnerability resulting from uninitialized memory in the Graphics: Canvas2D component of Mozilla Firefox. This vulnerability allows potential exposure of sensitive information due to improper memory initialization. It affects Firefox and Thunderbird versions prior to Firefox 150 and ESR 115.35/140.10. Mozilla has addressed this issue in the stated versions. The CVSS 3.1 base score is 7.5, reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact. The vendor advisories confirm the fix and recommend upgrading to the patched versions.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of information from the affected Firefox or Thunderbird applications. The impact is limited to confidentiality, with no integrity or availability effects reported. There are no known active exploits in the wild at this time.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official patches.