CVE-2026-0877: 
NixOS vulnerability analysis and mitigation

CVE-2026-0877 is a Permission Policy (Permissions Policy) mitigation bypass vulnerability in the DOM: Security component of Mozilla Firefox and Thunderbird. It was reported by security researcher Mingi Jung and disclosed on January 13, 2026. The vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird ESR < 140.7. It carries a CVSS v3.1 base score of 8.1 (High) (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The root cause is a Protection Mechanism Failure (CWE-693) in Firefox's DOM: Security component, specifically in the IPC serialization of LoadInfo — the PermissionsPolicy property was omitted from LoadInfoArgs, causing it to be lost when a cross-origin iframe navigated to a blob: URL. This allowed a cross-origin iframe to inherit or request browser permissions (e.g., geolocation, fullscreen) that the parent page's Permissions Policy was explicitly intended to deny. The attack requires a victim to visit a malicious or compromised web page that embeds a cross-origin iframe, which then navigates to a blob: URL containing JavaScript that requests restricted permissions. The regression was introduced by a prior fix for CVE-2024-6601 (Bug 1890748) (Mozilla Bugzilla).

Successful exploitation allows an attacker-controlled cross-origin iframe to bypass the host page's Permissions Policy and gain access to sensitive browser APIs — such as geolocation — that should be restricted. This results in high confidentiality impact (e.g., leaking the user's physical location) and high integrity impact (unauthorized access to browser functionality), with no availability impact. The scope is limited to the affected browser session, but the data exposed (e.g., precise geolocation) can be highly sensitive (Mozilla Advisory mfsa2026-01, Mozilla Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. User interaction is required — a victim must visit a malicious page — and the attacker must still obtain user permission grants at some point, which somewhat limits practical exploitability (Mozilla Bugzilla, Feedly).

1. Set up attacker infrastructure: Host a malicious parent page on one origin (e.g., attacker.com) and prepare a cross-origin iframe pointing to a second origin (e.g., evil-iframe.com).
2. Embed cross-origin iframe: The parent page at attacker.com embeds an iframe loading content from evil-iframe.com, which would normally be denied geolocation or other permissions by the parent's Permissions Policy.
3. Navigate iframe to blob: URL: JavaScript inside the cross-origin iframe creates a Blob containing HTML/JavaScript that requests a sensitive permission (e.g., navigator.geolocation.getCurrentPosition()), then navigates the iframe to the resulting blob: URL via URL.createObjectURL().
4. Permission Policy bypass triggered: Because the PermissionsPolicy is not correctly serialized in LoadInfoArgs for the blob navigation, the browser fails to enforce the parent's policy restrictions on the blob document.
5. Sensitive data exfiltrated: The blob document's JavaScript successfully requests and receives the restricted permission (e.g., geolocation coordinates), then transmits the data back to the attacker's server (Mozilla Bugzilla).

• Network: Outbound requests from the browser to unexpected third-party endpoints immediately after visiting a page with cross-origin iframes; geolocation data or other sensitive API responses transmitted to unknown external servers.
• Logs: Browser console errors or permission prompts appearing unexpectedly on pages that should not trigger permission requests; network traffic logs showing blob: URL navigations within iframes followed by API calls to sensitive endpoints.
• Behavior: Unexpected browser permission dialogs (e.g., geolocation) appearing when visiting pages that embed third-party iframes, particularly if the parent page's Permissions Policy should deny such requests.

Mozilla has released patched versions addressing this vulnerability: Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. Users and administrators should update to these versions immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise deployments using Red Hat, Debian, SUSE, Slackware, Rocky Linux, AlmaLinux, and Amazon Linux should apply the corresponding vendor-issued security errata (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-0877, could allow for arbitrary code execution and security bypass. Red Hat issued multiple errata (RHSA-2026:0667, RHSA-2026:0694, and others) for affected distributions. Security news outlets including CyberSecurityNews and CyberNoz covered the Firefox 147 release highlighting the 16 vulnerabilities fixed, including this bypass. Social media commentary from TheHackerWire on Mastodon and Bluesky noted the release. The vulnerability was awarded a bug bounty by Mozilla (CIS Advisory, Mozilla Bugzilla).