CVE-2026-6752 involves incorrect boundary conditions in the WebRTC component of Mozilla Firefox, classified under CWE-119 and CWE-131, indicating issues related to improper memory handling. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS v3.1 base score is 7.3 (high), with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Mozilla's security advisories (MFSA2026-30 and MFSA2026-31) confirm the fix and provide references to the underlying bugs. No known exploits in the wild have been reported. The vendor advisory indicates that the vulnerability is addressed in the stated fixed versions.

Successful exploitation of this vulnerability could allow an attacker to compromise confidentiality, integrity, and availability of the affected system due to improper boundary checks in the WebRTC component. This may lead to memory corruption issues, potentially enabling code execution or denial of service. However, no known active exploits have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update affected products to these versions or later to remediate the issue. Patch status is confirmed by Mozilla advisories. No additional mitigation steps are required beyond applying these updates.