CVE-2026-6770 is an information disclosure vulnerability in the IndexedDB storage component of Mozilla Firefox. It allows an attacker to gain limited unauthorized access to information without requiring privileges or user interaction. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) and was resolved in Firefox 150 and Firefox ESR 140.10. Mozilla's official security advisories (MFSA2026-30 and MFSA2026-32) list this vulnerability among multiple fixes in Firefox 150 and ESR 140.10. The vulnerability is categorized under CWE-200, indicating exposure of sensitive information. No active exploitation has been reported.

The vulnerability could allow an attacker to disclose limited information from the IndexedDB storage component remotely over the network without user interaction or privileges. The impact is limited to confidentiality and availability, with no integrity impact. No known exploits in the wild have been reported, and the issue is fixed in Firefox 150 and Firefox ESR 140.10.

Mozilla has fixed this vulnerability in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should upgrade to these versions or later to remediate this vulnerability. Since the vulnerability is fixed, no additional mitigation actions are required beyond applying the official updates.