CVE-2026-6753

HighCVSS 7.3/10Last modified Jul 15, 2026

Description

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-119CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Apr 21, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-675306.4WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.tCVE-2026-675319.3FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes lCVE-2026-67547.5Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, ThunCVE-2026-675497.6OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3CVE-2026-67556.5Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-675505.7re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte leCVE-2026-675517.5pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. TCVE-2026-675527.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issuCVE-2026-675536.5An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affectCVE-2026-675546.5An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handlingCVE-2026-675556.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excesCVE-2026-675587.4The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE adverti
CVE-2026-6753: High severity, CVSS 7.3 | Vulnix