CVE-2026-6754 is a high-severity use-after-free vulnerability (CWE-416) in the JavaScript Engine component of Mozilla Firefox. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to crashes or arbitrary code execution. This vulnerability was fixed in Firefox 150 and corresponding ESR and Thunderbird versions. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction and impacts availability but not confidentiality or integrity. Mozilla’s security advisories (MFSA2026-30 and MFSA2026-31) list this vulnerability among several memory safety bugs fixed in these releases.

The vulnerability could allow an attacker to cause a denial-of-service (crash) or potentially execute arbitrary code due to memory corruption in the JavaScript Engine. The CVSS score of 7.5 reflects a high impact on availability with no direct impact on confidentiality or integrity. No known exploits in the wild have been reported, reducing immediate risk, but the presence of memory corruption suggests exploitation could be possible with sufficient effort.

This vulnerability is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching client installations is required. There are no indications from the vendor advisory that additional mitigations or workarounds are necessary beyond applying the official updates.