CVE-2026-6771 is a critical mitigation bypass vulnerability affecting the DOM security component in Mozilla Firefox. This vulnerability allows bypassing security mitigations designed to protect the DOM, potentially leading to severe impacts on confidentiality, integrity, and availability. Mozilla fixed this issue in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. The vulnerability is part of a broader set of security fixes released simultaneously, addressing multiple memory safety and mitigation bypass issues. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on all security metrics.

The vulnerability allows an attacker to bypass security mitigations in the DOM security component, which could lead to full compromise of confidentiality, integrity, and availability of the affected application. Given the critical CVSS score of 9.8, exploitation could result in arbitrary code execution or other severe impacts. However, there are currently no known exploits in the wild. The issue affects Firefox versions prior to 150 and Firefox ESR versions prior to 140.10.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. Users and administrators should upgrade to these versions or later to remediate the vulnerability. Since the vendor advisory confirms the fix availability, no additional mitigation steps are required beyond applying the official updates.