CVE-2026-6748

The vulnerability results from the use of uninitialized memory in the module handling audio and video codecs (Web Codecs). When a browser or email client processes appropriately crafted multimedia data, it may read or write data from uninitialized memory areas. Such a state can be exploited by an attacker to control the program execution flow, which may consequently lead to arbitrary code execution on the victim's side.

An attacker can gain full control over the vulnerable application, including reading sensitive data from process memory, modifying data, and executing arbitrary code with the privileges of the attacked process. The network vector without required privileges and without user interaction (AV:N/AC:L/PR:N/UI:N) makes it possible for an exploit to be carried out remotely through a simple visit to a malicious website or opening a crafted message.

Mozilla Firefox should be immediately updated to version 150 or Firefox ESR to version 140.10, and Mozilla Thunderbird to version 150 or Thunderbird ESR to version 140.10. Updates are available directly from the manufacturer according to the references: https://www.mozilla.org/security/advisories/mfsa2026-30/ and related security advisories.

Mozilla Firefox in versions prior to 150 and Firefox ESR in versions prior to 140.10, as well as Mozilla Thunderbird in versions prior to 150 and Thunderbird ESR in versions prior to 140.10.