CVE-2026-0888: 
NixOS vulnerability analysis and mitigation

CVE-2026-0888 is an information disclosure vulnerability in the XML component of Mozilla Firefox and Thunderbird, specifically related to the XML pretty printer not respecting "spoof English" privacy settings. It affects Firefox and Thunderbird versions prior to 147.0. The vulnerability was reported by Pier Angelo Vendrame (originally discovered by researcher Thorin), disclosed on January 13, 2026, and fixed in Firefox 147 and Thunderbird 147. It carries a CVSS v3.1 base score of 5.3 (Medium) (Mozilla Advisory, Feedly).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The XML pretty printer in Firefox and Thunderbird renders localized introductory text when displaying XML documents, but failed to apply the browser's "spoof English" fingerprinting resistance setting to that text. An attacker-controlled page could embed an iframe pointing to an XML document and use getBoundingClientRect() on the first child element to measure the rendered height of the localized message. Because different application locales produce text of different heights, this measurement can be used to bucket users into language groups, leaking the user's actual application locale even when fingerprinting resistance (spoof English) is enabled. The fix, committed as d5c84ded52c6, adds a check in XMLPrettyPrinter to honor the spoof English setting (Mozilla Bugzilla, Mozilla Advisory).

The primary impact is a confidentiality breach: an attacker can infer a user's application locale (and by extension, potentially their language or region) by measuring XML pretty-print rendering dimensions via JavaScript, even when the user has enabled fingerprinting resistance. There is no integrity or availability impact. The vulnerability is particularly relevant to privacy-focused users and those relying on Tor Browser or Mullvad Browser's anti-fingerprinting protections, as it undermines locale-spoofing defenses and adds entropy to browser fingerprints (Mozilla Bugzilla, Mozilla Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028% (very low probability of exploitation in the next 30 days), and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability requires no authentication and no user interaction beyond visiting a malicious page, but its impact is limited to locale fingerprinting rather than code execution or data theft (Feedly).

1. Set up a malicious page: Host a web page that embeds an iframe pointing to an XML document (e.g., a simple well-formed XML file served with Content-Type: application/xml).
2. Trigger XML pretty print: When the browser loads the XML in the iframe, Firefox's XML pretty printer renders a localized introductory message (e.g., "This XML file does not appear to have...") in the user's application locale.
3. Measure rendered height: Use JavaScript to call document.querySelector('iframe').contentDocument.firstChild.getBoundingClientRect() to obtain the height of the first child element, which includes the localized message.
4. Vary iframe width: Resize the iframe to different widths to force line breaks and amplify height differences between locales, creating distinct measurement buckets.
5. Infer locale: Compare the measured height against a pre-built lookup table of heights per locale (as demonstrated in the bug report with 41 Tor Browser languages) to determine the user's actual application locale, bypassing spoof English protections (Mozilla Bugzilla).

Mozilla has released patches in Firefox 147 and Thunderbird 147, which add a check in the XMLPrettyPrinter to honor the browser's spoof English/fingerprinting resistance setting. ESR versions (115 and 140) were assessed as wontfix for this low-severity issue. Users should upgrade to Firefox 147 or Thunderbird 147 or later. No configuration-based workaround is available for unpatched versions beyond disabling JavaScript or avoiding untrusted XML-serving sites (Mozilla Advisory, Mozilla Advisory Thunderbird).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Mozilla products fixed in Firefox 147, including CVE-2026-0888, flagging the overall release as addressing issues that could allow arbitrary code execution (though this specific CVE is low severity). Coverage from cybersecurity news outlets such as CyberSecurityNews and Cybernoz highlighted the Firefox 147 release broadly. No significant individual researcher commentary or social media discussion specific to this CVE was identified beyond the technical details in the Mozilla Bugzilla report.