CVE-2026-7320 is a high-severity information disclosure vulnerability in Mozilla Firefox due to incorrect boundary conditions in the Audio/Video component, which could lead to unauthorized information exposure. It affects Firefox versions prior to 150.0.1 and corresponding ESR and Thunderbird versions. Mozilla released fixes in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1. The vulnerability is part of a set of memory safety bugs addressed in these releases, some of which showed evidence of memory corruption and potential for arbitrary code execution. The vendor advisories confirm the fixes and classify the impact as high to critical for related bugs. No known exploits have been reported in the wild.

The vulnerability allows information disclosure due to incorrect boundary checks in the Audio/Video component of affected Firefox versions. This could expose sensitive data to attackers without requiring user interaction or privileges. Related memory safety bugs fixed alongside this vulnerability indicate potential for more severe impacts such as arbitrary code execution, though this specific CVE is limited to information disclosure. The CVSS score of 7.5 reflects a high impact on confidentiality with no impact on integrity or availability.

Mozilla has released official fixes for this vulnerability in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying these official updates.