CVE-2026-24868: 
NixOS vulnerability analysis and mitigation

CVE-2026-24868 is a Content Security Policy (CSP) strict-dynamic bypass vulnerability in Firefox's Privacy: Anti-Tracking component, specifically within the Disqus embed shim logic. It affects all Firefox versions prior to 147.0.2 and was disclosed on January 27, 2026, via Mozilla Foundation Security Advisory 2026-06. The vulnerability was reported by external researcher Masato Kinugawa and carries a CVSS v3.1 base score of 6.5 (Medium), though Mozilla rates its impact as moderate (Mozilla Advisory, Feedly).

The root cause is classified as CWE-693 (Protection Mechanism Failure). Firefox's Strict Enhanced Tracking Protection feature shims certain tracking content, including Disqus embed code, blocking it until the user explicitly allows it. A flawed querySelector call in disqus-embed.js incorrectly selects a non-Disqus script element; when the user clicks "Allow," the SmartBlock embed helper injects this attacker-controlled script via createElement() without enforcing the page's CSP strict-dynamic policy, allowing arbitrary JavaScript execution (Mozilla Bugzilla). The regression was introduced by bug 1965307 and affects Firefox 146 and 147 (prior to 147.0.2), while Firefox ESR 115 and ESR 140 are unaffected (Mozilla Bugzilla).

Successful exploitation allows an attacker to execute arbitrary JavaScript on a victim's browser even when the hosting page enforces strict CSP rules with strict-dynamic, effectively nullifying a key web security control. The attack requires user interaction — specifically, the victim must have Strict Enhanced Tracking Protection enabled and must click the "Allow" button for Disqus content on a malicious or compromised page. The primary impact is an integrity violation: unauthorized script execution that could lead to session hijacking, credential theft, or further client-side attacks; there is no direct confidentiality or availability impact (Mozilla Advisory, Mozilla Bugzilla).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific precondition: the victim must have Firefox's Strict Enhanced Tracking Protection enabled and must interact with a page containing crafted Disqus-like embed code.

1. Craft a malicious page: Create an HTML page that includes a strict CSP policy (e.g., Content-Security-Policy: script-src 'strict-dynamic' 'nonce-...') and embed a script element crafted to be misidentified as a Disqus embed by Firefox's querySelector logic in disqus-embed.js, but pointing to an attacker-controlled script URL.
2. Lure the victim: Deliver the malicious page to a target Firefox user who has Strict Enhanced Tracking Protection enabled (the default in Strict mode).
3. Trigger the shim: Firefox detects what it believes is a Disqus embed and blocks it, displaying the SmartBlock UI with an "Allow on [site]" and "Allow Disqus" toggle button.
4. User interaction: The victim clicks the "Allow Disqus" toggle, triggering the SmartBlock embed helper (smartblock_embeds_helper.js) to inject the script via createElement().
5. CSP bypass achieved: Because the injected script bypasses strict-dynamic enforcement, the attacker-controlled script executes in the page context, enabling arbitrary JavaScript execution (e.g., alert(), cookie theft, or further exploitation) (Mozilla Bugzilla).

Mozilla has released Firefox 147.0.2, which contains the fix for this vulnerability; users should update immediately (Mozilla Advisory). The fix tightens the querySelector logic in disqus-embed.js to more strictly validate script source URIs before allowing injection. Firefox ESR 115 and ESR 140 are not affected and do not require updates. Organizations should prioritize deploying Firefox 147.0.2 or later across all managed endpoints and consider enabling automated browser update mechanisms.

The vulnerability was reported by external security researcher Masato Kinugawa, who also discovered a similar prior bug (Bug 1909241), and was awarded a security bounty by Mozilla (Mozilla Bugzilla). Mozilla rated the impact as "moderate" and expedited a patch via an out-of-band point release (147.0.2). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking.