CVE-2026-6780 is a denial-of-service vulnerability classified under CWE-400 affecting the Audio/Video playback component in Mozilla Firefox. The flaw allows an attacker to cause a denial-of-service condition remotely without requiring privileges or user interaction. This vulnerability was fixed in Firefox 150 as part of a comprehensive security update that addressed multiple high-impact memory safety and boundary condition issues across various components including DOM, WebRTC, JavaScript engine, and graphics subsystems. The advisory from Mozilla explicitly states that Firefox 150 and Thunderbird 150 contain the fixes for this and related vulnerabilities.

The vulnerability can be exploited remotely to cause a denial-of-service condition, potentially disrupting normal browser operation. There is no indication of confidentiality or integrity impact from this specific vulnerability. The CVSS vector indicates no required privileges or user interaction, increasing the risk of exploitation. However, no known exploits in the wild have been reported. The overall impact is high due to the potential for service disruption.

Mozilla has released an official fix for this vulnerability in Firefox 150 and Thunderbird 150. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.