CVE-2026-6747

CVE-2026-6747 is a use-after-free vulnerability in the WebRTC component affecting Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. This memory safety flaw allows attackers to exploit freed memory regions, potentially causing application crashes or other undefined behavior. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it easily exploitable over the internet. The primary impact is availability denial through application crashes, though the attack complexity is low and no special privileges are required. There is currently no evidence of active exploitation in the wild, with no known public exploit code available. The vulnerability remains inactive on threat intelligence hot lists, and its EPSS score of 0.00047 indicates minimal real-world exploitation probability at this time. However, organizations should prioritize patching given the high CVSS rating and ease of exploitation.