CVE-2026-6755 is a vulnerability in Mozilla Firefox's DOM postMessage component that allows bypassing of mitigation controls. The issue was reported by the researcher 'paranoidmoth' and is categorized under CWE-352 (Cross-Site Request Forgery). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and causing high impact on availability but no impact on confidentiality or integrity. Mozilla fixed this vulnerability in Firefox 150 and Thunderbird 150 as part of a security update addressing multiple issues.

The vulnerability allows an attacker to bypass mitigation mechanisms in the DOM postMessage component, which could potentially affect the availability of the affected application. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported. The issue is mitigated by updating to Firefox 150 or Thunderbird 150, where the vulnerability is fixed.

Mozilla has released an official fix for CVE-2026-6755 in Firefox 150 and Thunderbird 150. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official update.