CVE-2026-6776 is a vulnerability involving incorrect boundary conditions in the WebRTC Networking component of Mozilla Firefox. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The flaw was fixed in Firefox 150 and Firefox ESR 140.10, as documented in Mozilla security advisories MFSA 2026-30 and MFSA 2026-32. The advisories also cover multiple other memory safety bugs fixed in the same releases. No evidence of exploitation in the wild is currently known.

Successful exploitation of this vulnerability could allow an attacker with local access and user interaction to compromise confidentiality, integrity, and availability of the affected system through the WebRTC Networking component. The CVSS score and Mozilla's classification indicate a high impact. However, no known active exploits have been reported. The vulnerability affects Firefox versions prior to 150 and ESR versions prior to 140.10.

Mozilla has released official fixes for this vulnerability in Firefox 150 and Firefox ESR 140.10. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to mitigate the risk. Since this is not a cloud service, remediation depends on applying these updates. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as fixed in the specified versions.