CVE-2026-6782 is a high-severity information disclosure vulnerability affecting the IP Protection component in Mozilla Firefox. It allows unauthorized disclosure of information but does not affect integrity or availability. The vulnerability was fixed in Firefox 150 and Thunderbird 150 as part of a comprehensive security update that addressed multiple memory safety and other vulnerabilities. The vendor advisory explicitly states the fix is included in Firefox 150, confirming the availability of an official patch.

The vulnerability allows an attacker to gain unauthorized access to information within the IP Protection component, potentially exposing sensitive data. The CVSS score of 7.5 reflects a high impact on confidentiality. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild, reducing immediate risk but the potential for information leakage remains significant if unpatched.

An official fix is available and included in Mozilla Firefox version 150 and Thunderbird version 150. Users and administrators should update to these versions or later to remediate this vulnerability. No additional mitigation steps are required as the vendor advisory confirms the issue is resolved in the stated releases.