CVE-2026-0884: 
NixOS vulnerability analysis and mitigation

CVE-2026-0884 is a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. It was reported by Gary Kwong and Nan Wang, disclosed on January 13, 2026, and fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. All prior versions of these products are affected. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) as assessed by CISA-ADP, though Mozilla internally rated its impact as "moderate" (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-03).

The vulnerability is classified as CWE-416 (Use After Free) and originates in the JavaScript Engine's handling of Cross-Compartment Wrappers (CCWs) in relation to the Debugger API. Specifically, an assertion failure occurs at vm/Compartment-inl.h:105 when nukeAllCCWs() is called while a debugger statement is being evaluated — the CCW to the debugger object is nuked, leaving a dangling pointer that is subsequently accessed. The root cause was a regression introduced by a prior commit (Bug 1999464) that changed CCW nuking behavior without accounting for the debugger object's CCW. The fix prevents nuking of CCWs pointing to the main debugger object. Exploitation requires the ability to trigger the JavaScript Debugger API, which limits realistic attack surface to scenarios where a victim opens the browser's developer tools or a page can indirectly invoke debugger-related functionality (Mozilla Bugzilla).

Successful exploitation of this use-after-free could allow an attacker to achieve arbitrary code execution within the browser process, potentially leading to full compromise of the browser session, data theft, or malware installation. Confidentiality, integrity, and availability are all rated as high impact per the CVSS assessment. However, because exploitation requires interaction with the JavaScript Debugger API, the practical attack surface is more constrained than a typical drive-by browser vulnerability, and Mozilla assessed the severity as moderate (Mozilla Advisory mfsa2026-01, Feedly).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.04%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The requirement to interact with the Debugger API significantly reduces the likelihood of mass exploitation compared to typical browser use-after-free bugs (Feedly, Mozilla Bugzilla).

1. Identify target: Confirm the target is running a vulnerable version of Firefox (< 147 or ESR < 140.7), Thunderbird (< 147 or ESR < 140.7).
2. Trigger Debugger API context: Craft a JavaScript payload that creates a new global compartment and attaches a Debugger instance to it, as the vulnerability is only reachable through the Debugger API.
3. Invoke nukeAllCCWs: Within a onDebuggerStatement handler, call nukeAllCCWs() to invalidate Cross-Compartment Wrappers, including the CCW pointing to the debugger object.
4. Access freed memory: After nuking, trigger access to the now-freed debugger CCW (e.g., via w.environment.getVariable("x")), causing a use-after-free condition in Compartment::wrap.
5. Achieve code execution: Exploit the memory corruption resulting from the use-after-free to redirect execution flow and run arbitrary code within the browser process.

Note: This attack path requires the ability to execute JavaScript with access to privileged Debugger API features, limiting realistic exploitation to scenarios involving developer tools or privileged extension contexts (Mozilla Bugzilla).

Mozilla has released patches addressing this vulnerability. Users should update to Firefox 147 or later, Firefox ESR 140.7 or later, Thunderbird 147 or later, or Thunderbird ESR 140.7 or later. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize patching all Firefox and Thunderbird deployments, particularly those running ESR branches, using their standard patch management processes (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-03).

The vulnerability was covered by The Hacker Wire and noted in CIS security advisories as part of a broader set of Mozilla vulnerabilities fixed in Firefox 147 that could allow arbitrary code execution. CIS issued an advisory titled "Multiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code Execution" covering this and related CVEs. Community discussion was limited given Mozilla's moderate internal severity rating, and the bug was awarded a security bounty by Mozilla, split between the two reporters (CIS Advisory, The Hacker Wire).