Firefox WebAsm Null Pointer Bug Before v150 (CVE-2026-6757): CVE-2026-6757 April 2026

Firefox WebAsm Null Pointer Bug Before v150 (CVE-2026-6757)
CVE-2026-6757 Published on April 21, 2026

Invalid pointer in the JavaScript: WebAssembly component
Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Vulnerability Analysis

CVE-2026-6757 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

LOW

Weakness Type

Access of Uninitialized Pointer

The program accesses or uses a pointer that has not been initialized.

Products Associated with CVE-2026-6757

stack.watch emails you whenever new vulnerabilities are published in Mozilla Firefox or Mozilla Thunderbird. Just hit a watch button to start following.

Affected Versions

Version 140.10, <= 140.* is unaffected.

Version 150, <= * is unaffected.