CVE-2026-0878: 
NixOS vulnerability analysis and mitigation

CVE-2026-0878 is a sandbox escape vulnerability caused by incorrect boundary conditions in the Graphics: CanvasWebGL component of Mozilla Firefox and Thunderbird. Specifically, it is an out-of-bounds read due to a missing size check on shared memory when processing WebGL texture uploads. The vulnerability was reported by security researcher Oskar L, disclosed on January 13, 2026, and fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. It carries a CVSS v3.1 base score of 8.0 (High) (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-03, Feedly).

The root cause is improper input validation and improper restriction of operations within the bounds of a memory buffer (CWE-20, CWE-119) in SourceSurfaceSharedDataWrapper::Init. When a texture is uploaded via WebGL using an external shared surface (shared memory), the len parameter passed to EnsureMapped is not validated to ensure the mapped region encompasses the declared surface dimensions. This allows a malicious renderer process to declare a surface with dimensions larger than the actual shared memory allocation. During texture conversion in ConvertImage, a memcpy loop iterates based on the declared height and srcStride, reading beyond the mapped shared memory region into adjacent browser-process memory. The regression was introduced by Bug 1942129, which changed EnsureMapped to no longer enforce the length constraint. A proof-of-concept patch and reproduction HTML page were included in the bug report, demonstrating the out-of-bounds read via gl.texImage2D with an ImageBitmap and Y-flip enabled (Mozilla Bugzilla).

Successful exploitation allows a compromised renderer (content) process to read out-of-bounds memory in the browser (parent) process, constituting a sandbox escape. This results in high confidentiality impact (browser process memory disclosure) and high integrity impact (potential for further exploitation leveraging the information leak), with no direct availability impact. An attacker who already controls the renderer process — for example, via a separate content-process vulnerability — could chain this bug to fully escape the Firefox sandbox and compromise the underlying operating system or access sensitive data from other browser processes (Mozilla Advisory mfsa2026-01, Mozilla Bugzilla).

No public exploit code or weaponized exploit kit has been identified for CVE-2026-0878 as of the time of this report. The vulnerability requires user interaction (visiting a malicious web page) and high attack complexity, as it is most useful as a second-stage exploit chained with a content-process compromise. There is no evidence of in-the-wild exploitation, no CISA KEV catalog listing, and no known threat actor attribution. The EPSS score is approximately 0.043%, indicating low near-term exploitation probability (Feedly, Mozilla Bugzilla).

1. Prerequisite — Content Process Compromise: The attacker must first achieve code execution within a Firefox renderer (content) process, typically via a separate vulnerability (e.g., a JavaScript engine bug or another content-process flaw).
2. Craft Malicious Shared Surface: From the compromised renderer process, create a SourceSurfaceSharedData object with a small actual shared memory allocation (e.g., 0x1000 bytes) but declare a much larger surface size (e.g., width=0x1000, height=10, stride=width*4).
3. Register the Surface: Call SharedSurfacesChild::Share to register the undersized shared memory region with the browser process under a valid ExternalImageId.
4. Trigger WebGL Texture Upload: Construct a SurfaceDescriptorExternalImage referencing the malicious surface and send a TexImage IPC message to the browser process with flipY=true and applyUnpackTransforms=true to force the ConvertImage code path.
5. Out-of-Bounds Read: The browser process calls SourceSurfaceSharedDataWrapper::Init without validating that the mapped length covers the declared dimensions, then ConvertImage iterates memcpy calls reading srcStride * height bytes — far beyond the actual 0x1000-byte allocation — leaking adjacent browser-process memory.
6. Exfiltrate Data: The leaked memory contents (potentially containing pointers, credentials, or other sensitive data) can be returned to the attacker-controlled renderer process via the texture data pathway, enabling further exploitation or full sandbox escape (Mozilla Bugzilla).

• Process: Unexpected child processes spawned by the Firefox parent/browser process following WebGL-heavy page loads; Firefox GPU or content processes crashing with SIGSEGV or access violation errors referencing memcpy or ConvertImage in stack traces.
• Logs: AddressSanitizer or crash reports referencing mozilla::ConvertImage, TexUnpackBlob::ConvertIfNeeded, WebGLParent::RecvTexImage, or SourceSurfaceSharedDataWrapper::Init in stack traces; crash dumps from plugin-container or firefox processes with out-of-bounds read signatures.
• Network: Outbound connections from the Firefox process to unexpected remote hosts immediately following WebGL canvas rendering activity on a visited page.
• File System: Unexpected files written by the Firefox process to locations outside its normal profile directory, potentially indicating post-exploitation activity following a successful sandbox escape.

Mozilla has released patched versions addressing this vulnerability: Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. The fix adds a proper bounds check in SourceSurfaceSharedDataWrapper::Init to validate that the mapped shared memory region is sufficient for the declared surface dimensions before use. No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation. Organizations using enterprise-managed Firefox deployments should prioritize this update given the sandbox escape severity (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-03).

The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-0878, could allow for arbitrary code execution, recommending immediate patching (CIS Advisory). Red Hat issued multiple errata (RHSA-2026:0667, RHSA-2026:0694, and others) for affected Firefox and Thunderbird packages across RHEL versions. Security news outlets including CyberSecurityNews and CyberNoz covered the Firefox 147 release, highlighting the 16 vulnerabilities fixed including sandbox escapes. The vulnerability received a bug bounty award from Mozilla, as indicated by the sec-bounty+ flag in the Bugzilla report (Mozilla Bugzilla).