CVE-2026-6771

CVE-2026-6771 is a critical mitigation bypass vulnerability affecting the DOM Security component in Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR, with patches released in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The vulnerability allows attackers to circumvent existing security measures within the browser's DOM implementation, potentially enabling malicious activities on affected systems. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network-based attack vector requiring no privileges or user interaction, indicating near-universal exploitability. The attack complexity is low, and successful exploitation could result in complete compromise of system confidentiality, integrity, and availability. The FAUCET Risk Score of 55.0 out of 100 reflects a significant but not maximum threat level. There is currently no evidence of active exploitation, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and appears inactive on threat tracking lists. The EPSS score of 0.00047 is relatively low, suggesting minimal real-world exploitation activity to date. Organizations should prioritize patching affected Mozilla products but may have moderate time to implement updates compared to actively exploited vulnerabilities.