CVE-2026-6774

CVE-2026-6774 is a mitigation bypass vulnerability in the DOM Security component affecting Mozilla Firefox and Thunderbird, both of which received patches in version 150. The flaw allows attackers to circumvent existing security controls designed to protect the Document Object Model. This vulnerability carries a MEDIUM severity rating with a CVSS score of 5.4, reflecting moderate risk to affected systems. The attack requires network access and low attack complexity, but necessitates user authentication and interaction to exploit. The vulnerability can result in limited confidentiality and integrity compromise across security boundaries, though availability is not impacted. The affected CVSS vector indicates that successful exploitation would require authenticated users to click on malicious content, limiting the attack surface. There is no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities catalog and its inactive status on threat tracking lists. The EPSS score of 0.000370000 suggests this vulnerability is not currently a priority target for attackers. Overall, this represents a low-probability threat with manageable risk, primarily affecting users who have not yet applied the available patches to Firefox or Thunderbird 150.