CVE-2026-6777: Other issue in the Networking: DNS component
Analyzed
AliasesUBUNTU-CVE-2026-6777CGA-94jv-c486-pxpfCGA-gp2f-wgfv-33q8
Published 21-04-2026Last modified 27-05-2026
Vulnerability summary
CVE-2026-6777 is a medium (CVSS 5.3) Improper Input Validation vulnerability in mozilla firefox. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.6% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.23%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 21-04-2026PublishedVulnerability first disclosed.
- 27-05-2026Last modifiedVulnerability information updated.
Description
Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVSS metrics
3 scores · 3 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 0.16% on 23-09-2026
23-09-202623-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Ubuntu8 products
- mozjs102All versions (No fix recorded)
- mozjs115All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
Mozilla2 products
- firefox< 150.0
- thunderbird< 150.0
Chainguard1 product
- firefox< 150-r0
Wolfi1 product
- firefox< 150-r0
4 vendors · 12 products
References
6 links- bugzilla.mozilla.org/show_bug.cgi?id=2022726Permissions Required
- www.mozilla.org/security/advisories/mfsa2026-30/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-33/Vendor Advisory