CVE-2026-0880: 
NixOS vulnerability analysis and mitigation

CVE-2026-0880 is a sandbox escape vulnerability caused by an integer overflow in the Graphics component (CopyToImageSurface) of Mozilla Firefox and Thunderbird. Discovered and reported by external researcher Oskar L (oskarlindberg348), it was publicly disclosed on January 13, 2026. Affected versions include Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird ESR < 140.7. It carries a CVSS v3.1 base score of 8.8 (High) (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The root cause is an integer overflow (CWE-190) in the CopyToImageSurface function within gfx/2d/DrawTargetCairo.cpp. Specifically, the multiplication of y (int32) and surfStride (int32) produces an int32 result that is sign-extended before being added to the surfData pointer, causing the __dst argument of memcpy to point backwards into memory — resulting in an out-of-bounds read and write (OOBW/R). Cairo's maximum image surface dimension is 32767, and 32767 * 4 * 32767 = 0xFFFC0004, which overflows to a negative value when treated as a signed 32-bit integer. The vulnerability is reachable via the browser's printing subsystem (e.g., triggered by window.print() invoking DrawTargetCairo::StrokeRect with a crafted SurfacePattern), and affects both desktop and Android builds. The fix involved casting stride arithmetic to size_t to prevent signed integer overflow (Mozilla Bugzilla).

Successful exploitation allows an attacker to escape the Firefox/Thunderbird browser sandbox, achieving out-of-bounds memory read and write in the browser process. This can lead to full compromise of confidentiality, integrity, and availability of the affected system — enabling arbitrary code execution, access to sensitive user data, and potential for lateral movement beyond the browser sandbox. Both desktop and Android platforms are affected (Mozilla Advisory mfsa2026-01, Mozilla Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability requires user interaction — specifically, triggering the browser's print functionality (e.g., via window.print()) — which slightly raises the exploitation bar. The EPSS score is approximately 0.038% (low), and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The bug was awarded a security bounty by Mozilla, indicating it was assessed as a credible, exploitable issue (Mozilla Bugzilla).

1. Reconnaissance: Identify targets running vulnerable versions of Firefox (< 147, ESR < 115.32 or < 140.7) or Thunderbird (< 147, ESR < 140.7), including Android users.
2. Craft malicious web page: Create an HTML page that calls window.print() to trigger the browser's print rendering pipeline, which invokes DrawTargetCairo::StrokeRect.
3. Trigger integer overflow: Supply a crafted SurfacePattern with dimensions near Cairo's maximum (e.g., IntRect(0, 0, 0x7fff, 0x7fff)) so that the y * surfStride multiplication in CopyToImageSurface overflows a signed 32-bit integer, producing a negative offset.
4. Achieve out-of-bounds memory access: The negative offset causes memcpy's destination pointer to reference memory before the allocated surface buffer, enabling both out-of-bounds read and write in the browser process.
5. Escape sandbox: Leverage the OOB write primitive to corrupt browser process memory structures, bypassing the Firefox content process sandbox and achieving code execution in the browser process context (Mozilla Bugzilla, Mozilla Advisory mfsa2026-01).

• Process Behavior: Unexpected child processes spawned by the Firefox or Thunderbird process (e.g., shell processes, network utilities) following a print operation.
• Logs: Browser crash reports or AddressSanitizer-style heap-buffer-overflow errors referencing CopyToImageSurface or DrawTargetCairo.cpp in crash telemetry.
• Network: Unusual outbound connections from the browser process to unknown external IPs immediately after a print dialog is triggered on a web page.
• File System: Unexpected files written to temporary directories or the user profile directory by the browser process following print activity.
• Memory: ASAN reports indicating heap-buffer-overflow in mozilla::gfx::CopyToImageSurface or mozilla::gfx::DrawTargetCairo::StrokeRect (Mozilla Bugzilla).

Mozilla has released patched versions addressing this vulnerability: Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. Users should update immediately to one of these versions. As a temporary workaround prior to patching, organizations may consider restricting user access to untrusted websites and disabling JavaScript where feasible, which would prevent window.print() from being called by malicious pages. Downstream Linux distributions (Red Hat, Debian, SUSE, Rocky Linux, AlmaLinux, Amazon Linux) have also released updated packages (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-0880, could allow for arbitrary code execution. Security news outlets including CyberSecurityNews and CyberNoz covered the Firefox 147 release, highlighting the 16 vulnerabilities fixed including this sandbox escape. The vulnerability was awarded a Mozilla security bounty, reflecting its significance. No notable threat actor attribution or widespread social media controversy has been observed in connection with this CVE.