CVE-2026-6754 is a use-after-free vulnerability identified in the JavaScript Engine component of Mozilla Firefox. This memory safety bug can cause a denial of service and potentially other impacts related to memory corruption. The vulnerability affects Firefox versions prior to 150, Firefox ESR versions prior to 115.35 and 140.10, and Thunderbird versions prior to 150 and 140.10. Mozilla has addressed this issue with an official fix in Firefox 150 and the corresponding ESR and Thunderbird releases. The vulnerability was reported by security researchers and is documented in Mozilla's security advisories mfsa2026-30 and mfsa2026-31. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service).

Successful exploitation of this use-after-free vulnerability can result in denial of service (application crash) in affected Firefox versions. The CVSS score indicates no direct confidentiality or integrity impact but a high impact on availability. There are no known exploits in the wild reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should upgrade to these fixed versions or later to remediate the vulnerability. Patch status is confirmed by Mozilla advisories mfsa2026-30 and mfsa2026-31. No additional mitigation actions are required beyond applying the official updates.