CVE-2026-6772 involves incorrect boundary conditions in the NSS Libraries component of Mozilla Firefox and Thunderbird. This memory safety issue could potentially lead to confidentiality breaches. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is remotely exploitable without privileges or user interaction and impacts confidentiality. Mozilla fixed this vulnerability in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10 as documented in multiple Mozilla security advisories (MFSA2026-30, MFSA2026-31, MFSA2026-32).

The vulnerability allows an attacker to exploit incorrect boundary conditions in the NSS Libraries component, potentially leading to high confidentiality impact. The CVSS vector indicates no impact on integrity or availability, but full confidentiality compromise is possible. No known exploits in the wild have been reported. The issue affects multiple Firefox and Thunderbird versions prior to the fixed releases.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these versions or later to remediate the issue. Patch status is confirmed by Mozilla advisories. No additional mitigation actions are required beyond applying the official updates.