This set of vulnerabilities (CVE-2026-6785 and related CVEs) affects multiple Mozilla products including Firefox and Thunderbird in various ESR and regular release versions prior to Firefox 150 and ESR 115.35/140.10. The issues are primarily memory safety bugs such as use-after-free, uninitialized memory, and privilege escalation, which can lead to memory corruption and potentially arbitrary code execution. Mozilla has officially fixed these vulnerabilities in the stated versions. The vendor advisories provide detailed references to individual bugs and confirm the high impact severity of these issues.

The vulnerabilities present a high impact risk as they involve memory corruption that could allow an attacker to execute arbitrary code within the context of the affected application. This could lead to compromise of user systems running vulnerable versions of Firefox or Thunderbird. However, there are no reports of active exploitation in the wild at this time.

Mozilla has released official fixes for these vulnerabilities in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird ESR 140.10. Users and administrators should update to these fixed versions or later to remediate the vulnerabilities. Patch status is confirmed by Mozilla advisories. No additional mitigation actions are required beyond applying these updates.