CVE-2026-6758 is a use-after-free vulnerability identified in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption. This vulnerability was reported by multiple researchers and fixed in Firefox 150 and Thunderbird 150 as part of a broader set of memory safety fixes. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. The vendor advisory confirms the fix and recommends updating to the patched versions.

The vulnerability can cause a use-after-free condition in the WebAssembly component, which may lead to memory corruption and potentially denial of service. The CVSS score of 7.5 reflects a high severity impact primarily affecting availability. There is no evidence of exploitation in the wild reported at this time. The vulnerability affects Firefox and Thunderbird versions prior to 150, which are now fixed.

Mozilla has released official fixes for this vulnerability in Firefox 150 and Thunderbird 150. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official patches. Patch status is confirmed by the vendor advisory.