CVE-2026-0890: 
NixOS vulnerability analysis and mitigation

CVE-2026-0890 is a spoofing vulnerability in the DOM: Copy & Paste and Drag & Drop component of Mozilla Firefox and Thunderbird. The flaw causes the clipboard "paste" button to persist after tab navigation, potentially misleading users about the context in which clipboard access is being granted. It affects Firefox before version 147, Firefox ESR before 140.7, Thunderbird before 147, and Thunderbird ESR before 140.7. Disclosed on January 13, 2026, it carries a CVSS v3.1 base score of 5.4 (Medium), as assessed by CISA-ADP (Mozilla Advisory Firefox 147, Mozilla Advisory ESR 140.7).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing). Specifically, the clipboard "paste" button — which requests user permission for clipboard access — fails to be dismissed when the user navigates to a different tab, causing it to persist and remain associated with an inactive document. This means a user could be tricked into granting clipboard access to a page they have already navigated away from, as the UI element does not correctly reflect the current browsing context. The bug was reported internally by Edgar Chen and is tracked in Mozilla's Bugzilla as Bug 2005081 (Mozilla Bugzilla). The fix involved ensuring the clipboard paste button is dismissed upon navigation, following similar prior fixes for navigation-based spoofing with panels.

Successful exploitation could allow a malicious web page to spoof the clipboard permission UI, potentially tricking a user into granting clipboard read access to a page they have navigated away from. This primarily affects confidentiality, as an attacker could gain unauthorized access to clipboard contents (e.g., copied passwords, sensitive text), and availability is marginally impacted. Mozilla rated this vulnerability as "low" impact, and there is no evidence of integrity compromise or lateral movement potential beyond the browser session (Mozilla Advisory Firefox 147, Mozilla Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0890. The vulnerability requires user interaction (the user must navigate tabs while a clipboard paste prompt is active), limiting its practical exploitability. The EPSS score is approximately 0.038%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Mozilla Advisory Firefox 147).

1. Set up a malicious page: Host a web page that triggers a clipboard paste permission prompt (e.g., using the Clipboard API to request read access), causing the browser to display a "Paste" button to the user.
2. Induce tab navigation: Use social engineering or automated redirection to cause the user to navigate away from the malicious page to another tab or URL while the clipboard paste button is still visible.
3. Exploit persistent UI: Due to the bug, the clipboard paste button remains displayed even after navigation, still associated with the original (now inactive) malicious document.
4. Capture clipboard data: If the user clicks the persisted paste button, clipboard contents are sent to the original malicious page's document context, potentially exposing sensitive copied data to the attacker (Mozilla Bugzilla).

Mozilla has released patches addressing this vulnerability in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7. Users and administrators should update to these versions or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise deployments using ESR should target version 140.7 or later (Mozilla Advisory Firefox 147, Mozilla Advisory ESR 140.7).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in Mozilla products fixed in this release cycle, including CVE-2026-0890, flagging the overall update as addressing issues that could allow arbitrary code execution in other CVEs bundled in the same release. Coverage was largely routine, with security news outlets such as CyberSecurityNews reporting on the Firefox 147 release and its 16 vulnerability fixes collectively. No significant independent researcher commentary or social media discussion specific to CVE-2026-0890 has been identified, consistent with its low severity rating.