CVE-2026-0885: 
NixOS vulnerability analysis and mitigation

CVE-2026-0885 is a use-after-free vulnerability in the JavaScript Garbage Collector (GC) component of Mozilla Firefox and Thunderbird. It affects Firefox versions prior to 147, Firefox ESR versions prior to 140.7, Thunderbird versions prior to 147, and Thunderbird ESR versions prior to 140.7. The vulnerability was disclosed and patched on January 13, 2026, with Mozilla publishing security advisories mfsa2026-01, mfsa2026-03, mfsa2026-04, and mfsa2026-05. It carries a CVSS v3.1 base score of 6.5 (Medium), as assessed by CISA-ADP (Mozilla Firefox 147 Advisory, Mozilla ESR 140.7 Advisory).

The vulnerability is classified as CWE-416 (Use After Free) and stems from a race condition in SpiderMonkey's BufferAllocator within the JavaScript GC subsystem. Specifically, when the background PerformingGC thread's sweepForMinorCollection is delayed (by 3–6 ms due to CPU contention), it can execute concurrently with the main GC thread's mergeSweptData() while majorState is in State::NotCollecting, causing a chunk with allocatedDuringCollection still set to be accessed after it has effectively been freed — triggering a SEGV or assertion failure (!chunk->allocatedDuringCollection). The bug was introduced by a regression in Bug 1960811 ("Part 6: Set a flag at the end of major sweeping") and was discovered by external researcher Irvan Kurniawan (sourc7) through fuzzing with ASAN and debug builds, using canvas.createImageData() with large elements under high CPU load (Mozilla Bugzilla). The attack vector is network-based (AV:N), requires no privileges or user interaction, and has low attack complexity (Mozilla Firefox 147 Advisory).

Successful exploitation can lead to a browser crash (denial of service) or potential information disclosure due to access of freed memory. The CVSS assessment reflects low confidentiality impact and low availability impact with no integrity impact, consistent with a moderate-severity memory corruption issue. While arbitrary code execution has not been confirmed for this specific CVE, use-after-free vulnerabilities in browser JIT/GC components can in principle be chained with other vulnerabilities to achieve code execution within the browser process (Mozilla Firefox 147 Advisory, Mozilla ESR 140.7 Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0885. The EPSS score is approximately 0.037%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires triggering a specific race condition in the GC subsystem, which depends on high CPU load and precise timing, making reliable exploitation difficult without a tailored testcase (Mozilla Bugzilla, Feedly).

1. Craft a malicious web page: Create an HTML page that calls canvas.createImageData() with a large element size to trigger significant memory allocation in the JavaScript GC heap.
2. Induce high CPU load: Use background Web Workers running CPU-intensive JavaScript to saturate available CPU cores, increasing the likelihood of context-switch delays in the GC background thread.
3. Trigger GC race condition: Interact with the page (e.g., via scripted keyboard events) and reload the page within a narrow timing window (40–170 ms) to force an incremental GC sweep cycle to begin while the PerformingGC background thread is delayed.
4. Achieve use-after-free: The delayed sweepForMinorCollection background task runs concurrently with mergeSweptData() on the main thread, causing the GC to access a freed memory chunk — resulting in a SEGV crash or assertion failure that could potentially be leveraged for information disclosure.
5. Observe crash or memory disclosure: On vulnerable versions, the browser tab crashes with an AddressSanitizer DEADLYSIGNAL or assertion failure in BufferAllocator.cpp (Mozilla Bugzilla).

Mozilla has released patched versions that fully remediate this vulnerability: Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. Users and administrators should update to these versions immediately. No configuration-based workaround is available; upgrading is the only effective mitigation. Enterprise deployments using Red Hat, Rocky Linux, AlmaLinux, Debian, Slackware, SUSE, or Amazon Linux should apply the corresponding vendor-issued errata packages (e.g., RHSA-2026:0667, RHSA-2026:0694, and subsequent advisories) (Mozilla Firefox 147 Advisory, Mozilla ESR 140.7 Advisory).

The CIS (Center for Internet Security) published an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-0885, could allow for arbitrary code execution, recommending immediate patching. Red Hat, Rocky Linux, AlmaLinux, Debian, Slackware, SUSE, and Amazon Linux all issued security errata addressing this CVE shortly after Mozilla's disclosure. The vulnerability was reported by external researcher Irvan Kurniawan (sourc7) and was awarded a security bounty by Mozilla. Coverage was also noted on cybersecurity news outlets such as CyberSecurityNews and CyberNoz in the context of the broader Firefox 147 release (CIS Advisory, Mozilla Bugzilla).