CVE-2026-6766 is a high-severity vulnerability caused by incorrect boundary conditions in the NSS Libraries component used by Mozilla Firefox and Thunderbird. This flaw could lead to a confidentiality breach, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Mozilla fixed this issue in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The vulnerability is part of a broader set of memory safety and boundary condition issues addressed in these releases. No known exploits have been reported in the wild. The vendor advisories (MFSA2026-30 and MFSA2026-32) provide detailed information and confirm the availability of patches.

The vulnerability allows an attacker to potentially compromise confidentiality due to incorrect boundary conditions in the NSS Libraries component. The CVSS score of 7.5 reflects a high impact on confidentiality with no impact on integrity or availability. There are no known exploits in the wild, reducing immediate risk. However, unpatched versions prior to Firefox 150 and Firefox ESR 140.10 remain vulnerable.

Users and administrators should update affected Mozilla products to Firefox 150, Firefox ESR 140.10, Thunderbird 150, or Thunderbird 140.10 to remediate this vulnerability. The vendor advisories confirm that these versions include the official fixes. No additional mitigation actions are required beyond applying these updates.