CVE-2026-6779

Other issue in the JavaScript Engine component

Published Apr 21, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

Analysis

Technical impact

The vulnerability is identified as an ‘Other issue’ in the JavaScript Engine component of Mozilla products. The advisory does not provide a detailed technical description, so the exact nature of the flaw—whether it results in a crash, memory corruption, or another form of failure—is not disclosed. Users may encounter unexpected crashes or erratic browser behavior, but no confirmed remote code execution or data exfiltration is indicated.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. The issue existed in all releases prior to version 150 and was fixed in that release; no more granular version information is provided, so all revisions below 150 should be considered vulnerable.

Risk and Exploitability

The CVSS score is 5.3, indicating a medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can supply crafted JavaScript to a vulnerable client might attempt to trigger the bug, but without a detailed trigger or affected context the likelihood of successful exploitation remains uncertain. Administrators should treat the vulnerability as potentially high until further clarifying information is released.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`150`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`150`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[150,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox and Thunderbird to version 150 or later to apply the vendor fix.
If an immediate upgrade is not possible, consider disabling JavaScript for untrusted content or applying a strict Content Security Policy to restrict script execution.
Monitor the browser for crashes or anomalous behavior to confirm that the issue is adequately mitigated.

Generated by OpenCVE AI on April 22, 2026 at 05:42 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.208% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2023343
https://nvd.nist.gov/vuln/detail/CVE-2026-6779
https://www.cve.org/CVERecord?id=CVE-2026-6779
https://www.mozilla.org/security/advisories/mfsa2026-30/
https://www.mozilla.org/security/advisories/mfsa2026-33/

History

Apr 22, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::* cpe:2.3:a:mozilla:thunderbird:::::-:::*
Vendors & Products		Mozilla thunderbird

Apr 22, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-6779 https://www.cve.org/CVERecord?id=CVE-2026-6779
Metrics	threat_severity `None`	threat_severity `Important`

Apr 22, 2026 12:00 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.	Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
Weaknesses		CWE-119 CWE-20 CWE-79
References		https://www.mozilla.org/security/advisories/mfsa2026-33/
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 21, 2026 5:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Apr 21, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.
Title		Other issue in the JavaScript Engine component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2023343 https://www.mozilla.org/security/advisories/mfsa2026-30/

Subscriptions

Mozilla Firefox Thunderbird

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-20
Improper Input Validation
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')