CVE-2026-6771

The vulnerability classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) involves bypassing existing security controls in the DOM Security component. An attacker can exploit an alternative path or mechanism in the code handling the Document Object Model (DOM) to circumvent imposed security restrictions. The attack does not require elevated privileges or special network conditions, making it particularly dangerous in browser environments.

Successful exploitation of this vulnerability can lead to complete compromise of confidentiality, integrity, and availability of data processed by the application, which corresponds to maximum CVSS scores for all three categories (C:H/I:H/A:H).

Software should be updated to Firefox 150, Firefox ESR 140.10, Thunderbird 150, or Thunderbird 140.10, in which the vulnerability has been patched. Updates are available through official Mozilla distribution channels.

Mozilla Firefox versions before 150 and Firefox ESR before 140.10, as well as Mozilla Thunderbird versions before 150 and before 140.10.