CVE-2026-6768

The vulnerability consists of the ability to bypass applied security measures (mitigation bypass) in the Networking: Cookies component — the module responsible for handling cookies in network communication. An attacker can exploit an alternative path or access channel that is not covered by existing protection mechanisms, resulting in complete bypassing of security controls. The attack can be conducted remotely, without authentication and without any user interaction.

Successful exploitation of this vulnerability may lead to complete breach of confidentiality, integrity, and availability of data — the attacker gains the ability to unauthorized read, modify, or delete sensitive information processed by the application.

Mozilla Firefox must be immediately updated to version 150 or later, and Mozilla Thunderbird must be updated to version 150 or later. Detailed information is available in the vendor's security bulletins: mfsa2026-30 (Firefox) and mfsa2026-33 (Thunderbird).

Mozilla Firefox in versions prior to 150 and Mozilla Thunderbird in versions prior to 150.