CVE-2026-6760

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and involves circumventing implemented security measures in the component responsible for handling network cookies. An attacker can exploit an alternative path or mechanism to bypass imposed restrictions without requiring authentication, user interaction, or special privileges. The attack is possible remotely over the network, and low complexity indicates ease of execution.

Successful exploitation of this vulnerability may allow an attacker to gain unauthorized access to session data or sensitive information stored in cookies, as well as compromise the integrity and availability of the application using the affected component.

Mozilla Firefox should be updated to version 150 or later, and Mozilla Thunderbird should be updated to version 150 or later. Patches are available through official Mozilla distribution channels in accordance with vendor references (mfsa2026-30, mfsa2026-33).

Mozilla Firefox versions prior to 150 and Mozilla Thunderbird versions prior to 150.