CVE-2026-6784 covers a set of memory safety vulnerabilities in Mozilla Firefox 149 and Thunderbird 149. These include use-after-free, uninitialized memory, and incorrect boundary conditions that lead to memory corruption. The vulnerabilities could be exploited to run arbitrary code with high impact on confidentiality, integrity, and availability. Mozilla fixed these issues in Firefox 150 and Thunderbird 150. The advisory details multiple related CVEs with high and moderate impacts, emphasizing the critical nature of these memory safety bugs. No known exploits in the wild have been reported at the time of disclosure.

The vulnerabilities allow for potential arbitrary code execution due to memory corruption issues. This impacts confidentiality, integrity, and availability of the affected products. While Thunderbird's risk is mitigated by disabled scripting in mail reading contexts, Firefox users are exposed to higher risk. The overall impact is rated high with a CVSS score of 7.5. No known active exploitation has been observed.

Mozilla has released official fixes in Firefox 150 and Thunderbird 150. Users and administrators should update to these versions or later to remediate the vulnerabilities. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official updates.