PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6773 Mozilla CVE debrief

Mozilla Firefox and Thunderbird users should assess exposure to a denial-of-service vulnerability caused by an integer overflow in the Graphics: WebGPU component. Defenders should verify if their deployments use affected versions and prioritize remediation or compensating controls. The CVE record was published on 2026-04-21T13:16:23.087Z and has not been modified since then.

Vendor
Mozilla
Product
Firefox
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-21
Original CVE updated
2026-10-26
Advisory published
2026-04-21
Advisory updated
2026-10-26

Who should care

Defenders responsible for Mozilla Firefox and Thunderbird deployments should assess exposure and prioritize remediation or compensating controls.

Why it matters

CVE-2026-6773 is a denial-of-service vulnerability in Mozilla Firefox and Thunderbird due to an integer overflow in Graphics: WebGPU. Defenders should verify exposure, prioritize remediation, and monitor for potential attacks. The CVE record was published on 2026-04-21T13:16:23.087Z and has not been modified since then.

  • Denial-of-service attacks could disrupt service availability.
  • Verification of affected versions and patching are required to mitigate the vulnerability.
  • Exposure could lead to increased risk of service disruption.
  • Remediation priority is high due to the HIGH CVSS severity score.

Technical summary

The vulnerability (CVE-2026-6773) is caused by an integer overflow in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. This could lead to a denial-of-service attack. The issue was fixed in Firefox 150 and Thunderbird 150. Defenders should assess exposure in their deployments, prioritize patching or mitigations, and monitor for potential attacks. The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.5 and HIGH severity.

Defensive priority

Defenders should prioritize verifying exposure in their Firefox and Thunderbird deployments and apply patches or mitigations as needed.

Recommended defensive actions

  • Verify if Firefox and Thunderbird deployments are using affected versions (prior to 150.0).
  • Apply patches or updates to Firefox and Thunderbird to version 150 or later.
  • Monitor for potential denial-of-service attacks targeting this vulnerability.
  • Review and update incident response plans to address potential exploitation.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.5 and HIGH severity. Mozilla has released advisories (MFSA2026-30 and MFSA2026-33) addressing the issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6773 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6773

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6773 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6773

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.