CVE-2026-0879: 
NixOS vulnerability analysis and mitigation

CVE-2026-0879 is a sandbox escape vulnerability caused by incorrect boundary conditions in Firefox's Graphics component, specifically in the Cairo-based print rendering path. It affects Firefox before 147, Firefox ESR before 115.32, Firefox ESR before 140.7, Thunderbird before 147, and Thunderbird ESR before 140.7. The vulnerability was reported by security researcher Oskar L, disclosed and patched on January 13, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical), assigned by CISA-ADP (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The root cause (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) lies in the CopyToImageSurface function within DrawTargetCairo.cpp. When Firefox's print subsystem processes drawing operations via the PRemotePrintJob IPC actor and PrintTranslator, it converts surface formats using GfxFormatToCairoFormat. If the source surface uses a format with more than 4 bytes per pixel (e.g., SurfaceFormat::HSV), the function falls back to CAIRO_FORMAT_ARGB32 (4 bytes/pixel) for the destination Cairo surface, but calculates the copy size using the larger source format's bytes-per-pixel value. The resulting memcpy at DrawTargetCairo.cpp:226 reads and writes beyond the bounds of the allocated Cairo surface backing store, enabling an out-of-bounds write in the browser (parent) process from the sandboxed content process — constituting a sandbox escape (Mozilla Bugzilla #2004602).

Successful exploitation allows an attacker to escape Firefox's content process sandbox and achieve arbitrary code execution in the browser's privileged parent process. This results in high impact to confidentiality, integrity, and availability — an attacker could access sensitive user data, modify system resources, install malware, or fully compromise the host system. The vulnerability affects all supported platforms including Android (Mozilla Advisory mfsa2026-01, Mozilla Bugzilla #2004602).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.044%, reflecting low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the CVSS score of 9.8 and the network-accessible, no-user-interaction attack vector make it a high-priority patching target. The bug was awarded a security bounty by Mozilla, indicating it was assessed as a credible, exploitable issue (Mozilla Bugzilla #2004602).

1. Identify target: Locate systems running vulnerable Firefox (< 147), Firefox ESR (< 115.32 or < 140.7), Thunderbird (< 147), or Thunderbird ESR (< 140.7).
2. Trigger print path: Deliver a malicious web page or email that invokes window.print() or otherwise triggers the PRemotePrintJob IPC actor from the content process. According to the bug report, the ProcessPage IPC message is sent to the parent process without requiring explicit user interaction beyond loading the page.
3. Craft malicious surface: Construct a drawing operation (e.g., StrokeRect) using a SurfacePattern backed by a surface with a high-byte-per-pixel format such as SurfaceFormat::HSV and a large sampling rectangle.
4. Trigger OOB write: When PrintTranslator::TranslateRecording processes the recorded drawing event, CopyToImageSurface allocates a Cairo surface sized for 4 bytes/pixel but copies data using the larger source format's pixel width, causing an out-of-bounds write in the browser process memory.
5. Achieve sandbox escape: Exploit the out-of-bounds write to corrupt browser process memory, enabling arbitrary code execution outside the content process sandbox with the privileges of the Firefox parent process (Mozilla Bugzilla #2004602).

Mozilla has released patches addressing this vulnerability in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. Users and administrators should update immediately to one of these versions. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize deployment via their software management tools, and consider restricting browser usage or applying additional endpoint protection if immediate patching is not feasible (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The CIS published an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-0879, could allow for arbitrary code execution (CIS Advisory). Red Hat issued multiple errata (RHSA-2026:0667, RHSA-2026:0694, and others) for affected Firefox and Thunderbird packages across RHEL versions. Security news outlets including CyberSecurityNews and CyberNoz covered the Firefox 147 release, highlighting the 16 vulnerabilities fixed including sandbox escapes. The vulnerability received a security bounty from Mozilla, reflecting its severity assessment.