CVE-2026-6767 Mozilla CVE debrief

Who should care

Defenders of Mozilla Firefox, Firefox ESR, and Thunderbird deployments should assess exposure and prioritize updates to patched versions. This includes reviewing and applying Mozilla's security advisories for patched versions, updating to the latest versions, and verifying that compensating controls are in place for exposed systems. Defenders should also review relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-6767 is a medium-severity vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird that requires verification and potential updates to prevent security risks. Defenders of these deployments should assess exposure and prioritize updates to patched versions.

• Verify and update Firefox to version 150 or later to prevent potential security risks
• Verify and update Firefox ESR to version 115.35 or later, or 140.10 or later to prevent potential security risks
• Verify and update Thunderbird to version 150 or later, or 140.10 or later to prevent potential security risks
• Assess exposure and prioritize updates for Mozilla Firefox, Firefox ESR, and Thunderbird deployments

Technical summary

The vulnerability, CVE-2026-6767, is an issue in the Libraries component in NSS, affecting Mozilla Firefox, Firefox ESR, and Thunderbird. It was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The vulnerability has a medium severity and requires verification and potential updates to prevent security risks. Defenders of these deployments should assess exposure and prioritize updates to patched versions. The CVE record and NVD vulnerability detail page provide information on the vulnerability, which was fixed in multiple versions of Firefox, Firefox ESR, and Thunderbird.

Defensive priority

Medium priority for defenders of Mozilla Firefox, Firefox ESR, and Thunderbird deployments

Recommended defensive actions

• Review and apply Mozilla's security advisories (MFSA 2026-30, MFSA 2026-31, MFSA 2026-32, MFSA 2026-33, MFSA 2026-34) for patched versions
• Update Firefox to version 150 or later
• Update Firefox ESR to version 115.35 or later, or 140.10 or later
• Update Thunderbird to version 150 or later, or 140.10 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, which was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.