CVE-2026-0889: 
NixOS vulnerability analysis and mitigation

CVE-2026-0889 is a denial-of-service vulnerability in the DOM: Service Workers component of Mozilla Firefox and Thunderbird. It affects Firefox and Thunderbird versions prior to 147.0, and was disclosed on January 13, 2026, as part of Mozilla Foundation Security Advisory MFSA2026-01 and MFSA2026-04. The vulnerability was reported by external researchers Elysee Franchuk and Caleb Lerch and is rated low impact by Mozilla. It carries a CVSS v3.1 base score of 7.5 (High) as assessed by CISA-ADP (Mozilla Advisory, Mozilla Bugzilla).

The root cause is uncontrolled resource consumption (CWE-400) in Firefox's Service Worker implementation within the Gecko engine. When a malicious web page registers a Service Worker with an excessively large script body (e.g., gigabytes of data), Firefox fails to validate the script length before processing it, triggering a MOZ_RELEASE_ASSERT failure in nsTStringRepr.h at the nsTStringLengthStorage constructor when the string length exceeds the uint32_t-bounded kMax value. This assertion failure causes a crash of the entire browser process (not just the content process tab), resulting in a segmentation fault on Linux due to a null pointer dereference in MOZ_CrashSequence. The fix, committed by Harveer Singh, adds a length check before processing the worker script to return an error when the threshold is exceeded (Mozilla Bugzilla).

Successful exploitation causes a complete crash of the Firefox or Thunderbird browser process, resulting in a high availability impact for the affected user. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. Any user visiting a malicious web page is susceptible, and the crash affects the entire browser (not just a single tab), making it more disruptive than typical tab-level crashes (Mozilla Advisory, Mozilla Bugzilla).

A proof-of-concept Python HTTP server exploit was publicly disclosed by the reporters in the Mozilla Bugzilla issue, demonstrating reliable browser crashes on every visit to the malicious page (Mozilla Bugzilla). The attack requires no authentication, no user interaction beyond visiting a page, and has low complexity, making it trivially exploitable remotely. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.04%, indicating low probability of near-term exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Set up a malicious server: Deploy a Python HTTP server (as demonstrated in the PoC) that serves an oversized Service Worker script — for example, a JavaScript file containing a string of approximately 8 billion characters ('A' * 8000000000).
2. Serve the payload dynamically: Configure the server to respond to requests matching a pattern like /sw/<random_id>/sw.js with the oversized script body, using cache-control headers to prevent caching.
3. Lure the victim: Host an HTML page at the server root that uses navigator.serviceWorker.register() to register one or more Service Workers pointing to the oversized script URLs with randomized scopes.
4. Trigger the crash: When a victim running Firefox or Thunderbird < 147 visits the malicious page, the browser fetches the oversized Service Worker script. Firefox's CompareNetwork::OnStreamComplete passes the full script to nsTSubstring::Adopt, which triggers the MOZ_RELEASE_ASSERT in nsTStringLengthStorage due to the script exceeding the maximum allowed string length, crashing the entire browser process (Mozilla Bugzilla).

• Network: Outbound HTTP GET requests from the browser to a remote server fetching JavaScript files with paths matching patterns like /sw/<random_alphanumeric_id>/sw.js; unusually large HTTP response bodies (gigabytes) for JavaScript content-type responses.
• Logs: Firefox crash reports submitted to crash-stats.mozilla.org with crash signatures referencing MOZ_CrashSequence, nsTStringLengthStorage, or nsTSubstring::Adopt; assertion failure messages containing "string is too large" in browser crash logs.
• Process: Sudden termination of the firefox or thunderbird process without user-initiated close action; segmentation fault (signal 11) recorded in system logs on Linux (/var/log/syslog or journalctl) attributed to the Firefox process (Mozilla Bugzilla).

Mozilla has released patches in Firefox 147 and Thunderbird 147, which add a script length validation check before processing Service Worker scripts, returning an error instead of crashing when the threshold is exceeded. Users should upgrade to Firefox 147 or Thunderbird 147 immediately. No configuration-based workaround is available; disabling Service Workers via browser settings or enterprise policy (dom.serviceWorkers.enabled = false) could mitigate the risk if patching is not immediately possible, though this may break legitimate web functionality (Mozilla Advisory, Mozilla Advisory MFSA2026-04).

The CIS (Center for Internet Security) published an advisory noting multiple vulnerabilities in Mozilla products fixed in Firefox 147, including CVE-2026-0889. Security news outlets including CyberSecurityNews and CyberNoz covered the Firefox 147 release, highlighting the 16 vulnerabilities addressed. The vulnerability was rated "low" impact by Mozilla, reflecting its DoS-only nature with no memory corruption or code execution potential, which limited broader community concern.