CVE-2026-0881: 
NixOS vulnerability analysis and mitigation

CVE-2026-0881 is a sandbox escape vulnerability in the Messaging System component of Mozilla Firefox and Thunderbird, specifically in the BackupUI actor, which fails to verify that incoming messages originate from a privileged process. It affects Firefox and Thunderbird versions prior to 147.0. Reported by Andrew McCreight and disclosed on January 13, 2026, the vulnerability was fixed in Firefox 147 and Thunderbird 147. It carries a CVSS v3.1 base score of 10.0 (Critical), assigned by CISA-ADP (Mozilla Advisory, Feedly).

The root cause is an improper access control flaw (CWE-284) combined with a protection mechanism failure (CWE-693) in the BackupUIParent actor within Firefox's Messaging System. A regression introduced by Bug 1979439 allowed chrome://browser/content/spotlight.html to be loaded in unprivileged content processes in addition to the originally intended privileged about: pages; the receiveMessage method of the BackupUI actor did not validate the remote type of the calling process, meaning any content process that had been compromised could load spotlight.html and send messages to the BackupUI actor. This could allow an attacker to trigger backup-related operations — such as restoring a profile from an attacker-specified file, enabling or disabling encryption with an attacker-controlled password, or scheduling backups — effectively escaping the browser sandbox (Mozilla Bugzilla, Mozilla Advisory). The fix adds a check in receiveMessage to ensure messages are only accepted from privileged about: page contexts, mirroring the approach used by the MigrationWizard actor (Mozilla Bugzilla).

Successful exploitation allows an attacker who has already compromised a Firefox content process to escape the browser sandbox and execute arbitrary code or perform privileged operations on the host system. Concrete capabilities exposed include restoring a Firefox profile from an attacker-specified file path (enabling potential code execution or data manipulation), enabling or disabling profile backup encryption with an attacker-controlled password (enabling a ransomware-like scenario), and obtaining local file system path information from the BackupService state. The CVSS score reflects full confidentiality, integrity, and availability impact with a changed scope, indicating the potential for complete host system compromise beyond the browser process (Mozilla Bugzilla, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.055%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a prior compromise of a Firefox content process (e.g., via a separate renderer vulnerability), making it a second-stage attack primitive rather than a standalone exploit. No threat actor attribution has been reported.

1. Gain content process access: Exploit a separate renderer vulnerability (e.g., a JavaScript engine bug or memory corruption flaw) to achieve code execution within a Firefox unprivileged content process.
2. Load the spotlight document: From the compromised content process, navigate or load chrome://browser/content/spotlight.html, which was incorrectly permitted to instantiate the BackupUI actor in non-privileged contexts due to the regression in Bug 1979439.
3. Send privileged messages to BackupUI actor: Craft and send IPC messages to the BackupUIParent actor's receiveMessage handler. Because the handler does not validate the remote type of the sender, messages from the unprivileged process are accepted.
4. Trigger privileged operations: Use the actor's capabilities to, for example, specify an attacker-controlled file path for profile restoration via IOUtils.getFile(), retrieve local file system paths from BackupService state, or enable backup encryption with an attacker-chosen password.
5. Achieve sandbox escape: The privileged operations executed by the parent process on behalf of the attacker's content process effectively break the sandbox boundary, enabling file system access, data exfiltration, or further persistence on the host (Mozilla Bugzilla).

• Process: Unexpected loading of chrome://browser/content/spotlight.html from a non-privileged content process; unusual child processes spawned by the Firefox parent process following BackupUI actor activity.
• Logs: Firefox crash reports or error logs referencing BackupUIParent.sys.mjs or BackupUIChild.sys.mjs from unexpected contexts; IPC message logs showing BackupUI actor messages originating from non-about: page contexts.
• File System: Unexpected Firefox profile backup files created or modified in unusual locations; new or modified files at paths that could have been supplied by an attacker via IOUtils.getFile(); changes to profile backup encryption settings.
• Network: Outbound connections from the Firefox process to unexpected external hosts following exploitation of a renderer vulnerability (indicative of a chained attack).

Mozilla has released patches in Firefox 147 and Thunderbird 147, which add a privileged-process origin check to the BackupUI actor's receiveMessage method. Users should update to Firefox 147 or later and Thunderbird 147 or later immediately. Firefox ESR 115 and ESR 140 are confirmed unaffected. For environments where immediate patching is not possible, consider restricting network access to Firefox instances and monitoring for suspicious BackupUI-related activity in application logs (Mozilla Advisory, Mozilla Bugzilla).

The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-0881, could allow for arbitrary code execution (CIS Advisory). The Western Australian Government's SOC also issued a maximum-severity advisory for the Mozilla vulnerabilities. Security news outlets including CyberSecurityNews and CyberNoz covered the Firefox 147 release, highlighting the 16 vulnerabilities addressed. The bug was internally rated sec-high by Mozilla engineers, with discussion noting the realistic potential for a ransomware-like scenario via the backup encryption capability (Mozilla Bugzilla).