CVE-2026-0882: 
NixOS vulnerability analysis and mitigation

CVE-2026-0882 is a use-after-free (UAF) vulnerability in the Inter-Process Communication (IPC) component of Mozilla Firefox and Thunderbird. Reported by Randell Jesup and disclosed on January 13, 2026, it affects Firefox versions prior to 147, Firefox ESR prior to 115.32 and 140.7, Thunderbird prior to 147, and Thunderbird ESR prior to 140.7. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), assigned by CISA-ADP (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The root cause (CWE-416: Use After Free) lies in how Mozilla's ChildProcessChannelListener stores std::function objects in a nsTHashMap. The MSVC STL implementation of std::function can contain internal self-referential pointers, making it unsafe to relocate via memmove. However, the hash table's key type (nsIntegralHashKey) had ALLOW_MEMMOVE = true set, causing the hash table to use memmove when growing — invalidating internal pointers within the stored std::function objects and producing a use-after-free condition. Exploitation requires user interaction (e.g., visiting a malicious webpage or opening crafted content), as the attack vector is network-based with no privileges required (Mozilla Bugzilla #1924125). The fix involved preventing memmove for STL types through nsTHashtable by applying the MOZ_NEEDS_MEMMOVABLE_TYPE attribute appropriately (Mozilla Bugzilla #1924125).

Successful exploitation could result in memory corruption leading to potential arbitrary code execution within the context of the browser process, with high impact to confidentiality, integrity, and availability. An attacker could leverage this to read sensitive data, modify application behavior, or cause a crash. The vulnerability affects both desktop browser (Firefox) and email client (Thunderbird) users across Windows, Linux, and Android platforms (Mozilla Advisory mfsa2026-01, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The bug was originally observed as a crash pattern triggered by a specific local HTML file, suggesting it was discovered through crash telemetry rather than active exploitation (Mozilla Bugzilla #1924125).

1. Reconnaissance: Identify users running vulnerable versions of Firefox (< 147, ESR < 115.32 or < 140.7) or Thunderbird (< 147, ESR < 140.7) using browser fingerprinting or targeting known enterprise deployments on older ESR branches.
2. Craft malicious content: Develop an HTML page or email content that triggers repeated IPC channel redirections, causing ChildProcessChannelListener::RegisterCallback to be called in a way that forces the internal nsTHashMap to grow and relocate its entries via memmove.
3. Trigger the UAF: When the hash table grows, the std::function objects stored as values are relocated using memmove, invalidating their internal self-referential pointers. A subsequent call to ChildProcessChannelListener::OnChannelReady dereferences the now-freed/corrupted pointer.
4. Achieve memory corruption: The freed memory region is accessed, potentially allowing an attacker to control the corrupted std::function vtable pointer and redirect execution flow.
5. Arbitrary code execution: With control over the instruction pointer, execute a shellcode payload or ROP chain to achieve code execution in the browser's content process (Mozilla Bugzilla #1924125).

• Process: Unexpected crashes of firefox.exe or thunderbird.exe with crash signatures referencing std::_Func_class::operator() or mozilla::dom::ChildProcessChannelListener::OnChannelReady in crash reports.
• Logs: Mozilla crash reporter submissions (Socorro) showing the crash signature [@ std::_Func_class::operator() | mozilla::dom::ChildProcessChannelListener::OnChannelReady]; repeated access violation exceptions (EXCEPTION_ACCESS_VIOLATION_READ) in Windows event logs from Firefox/Thunderbird processes.
• Network: Outbound connections from Firefox or Thunderbird to unexpected external hosts shortly after visiting an unfamiliar webpage or opening an email with embedded content.
• File System: Presence of unexpected files or executables written to disk by the Firefox or Thunderbird process, which may indicate post-exploitation activity following successful code execution (Mozilla Bugzilla #1924125).

Mozilla has released patched versions addressing this vulnerability: Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. Users and administrators should update immediately to one of these versions. No configuration-based workaround is available; upgrading is the only effective remediation. Enterprise administrators should prioritize updating ESR deployments, as ESR branches are commonly used in managed environments and may lag behind on updates (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-0882, could allow for arbitrary code execution, recommending immediate patching (CIS Advisory). Red Hat issued multiple errata (RHSA-2026:0667, RHSA-2026:0694, and others) addressing this CVE across RHEL product lines. Security news outlets including CyberSecurityNews and CyberNoz covered the Firefox 147 release highlighting the 16 vulnerabilities fixed, including this UAF. Community reaction was measured given the absence of active exploitation and the availability of patches at the time of disclosure.