{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6753", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-04-21T12:40:49.549Z", "datePublished": "2026-04-21T12:40:49.893Z", "dateUpdated": "2026-04-21T23:34:45.288Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "140.10", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "150", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "140.10", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "150", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]}], "title": "Incorrect boundary conditions in the WebRTC component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2027501"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"}], "credits": [{"lang": "en", "value": "jmwebdevelopement"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-21T23:34:45.288Z"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}], "id": "CVE-2026-6753", "lastModified": "2026-04-22T00:16:31.117", "metrics": {}, "published": "2026-04-21T13:16:21.340", "references": [{"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2027501"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Undergoing Analysis"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[140.10,140.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[150,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Firefox", "source": "cna", "vendor": "Mozilla"}, "product": "firefox", "vendor": "mozilla"}], "analysis": {"en": {"generated_at": "2026-04-22T05:47:04.248573+00:00", "value": {"mitigation_remediation": ["Upgrade to Firefox 150 or ESR 140.10 (or a later security\u2011patched release).", "Upgrade to Thunderbird 150 or ESR 140.10 (or a later security\u2011patched release).", "Disable WebRTC functionality if it is not required, for example by using the browser setting or add\u2011on that turns off WebRTC.", "Block WebRTC traffic at the network perimeter by configuring firewalls or proxy rules to drop UDP/SCTP and the associated ports."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Mozilla Firefox and Mozilla Thunderbird are affected. Versions up to 149 in the standard release track and ESR releases prior to 140.10 are vulnerable. The flaw was fixed in Firefox 150 and in the Firefox ESR 140.10 release, as well as in Thunderbird 150 and Thunderbird 140.10.", "description_and_impact": "Incorrect boundary conditions in the WebRTC component used by Mozilla Firefox and Thunderbird can lead to memory corruption, which may enable an attacker to execute arbitrary code on the affected system. The likely attack vector is remote network traffic that sends crafted WebRTC packets to the victim, allowing compromise of confidentiality, integrity, and availability. The weakness represents a classic buffer overflow scenario, potentially enabling both local and remote code execution within the WebRTC pipeline.", "risk_and_exploitability": "The CVSS score is not provided and EPSS data is unavailable, so the exploitation probability cannot be quantified. However, because the flaw involves incorrect boundary checks that can trigger memory corruption, the potential impact is high. No known exploits are publicly documented, and the issue is not listed in the CISA KEV catalog, indicating it has not yet been actively exploited in the wild. Organizations using older Firefox or Thunderbird builds should treat this as a high\u2011risk vulnerability until they can upgrade."}}}}, "created": "2026-04-21T16:45:15.078298+00:00", "updated": "2026-04-22T06:00:09.650886+00:00", "vendors": ["mozilla", "mozilla$PRODUCT$firefox"]}