CVE-2026-6759 is a use-after-free vulnerability (CWE-416) affecting the Widget: Cocoa component in Mozilla Firefox. Use-after-free vulnerabilities occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption or application crashes. This issue was fixed in Firefox 150 and Firefox ESR 140.10, as well as Thunderbird 150 and Thunderbird 140.10. The vulnerability has a CVSS v3.1 base score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability could lead to denial of service due to memory corruption caused by use-after-free in the Widget: Cocoa component. There is no evidence of confidentiality or integrity impact. No known exploits in the wild have been reported. The high CVSS score reflects the potential for significant disruption to availability.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these versions or later to remediate the vulnerability. Since the vendor advisory confirms the fix, no additional mitigation steps are required beyond applying the official updates.