CVE-2026-24869: 
NixOS vulnerability analysis and mitigation

CVE-2026-24869 is a use-after-free (UAF) vulnerability in the Layout: Scrolling and Overflow component of Mozilla Firefox, affecting all versions prior to 147.0.2. The flaw was reported by Hiroyuki Ikezoe and publicly disclosed on January 27, 2026, via Mozilla Foundation Security Advisory MFSA2026-06. It carries a CVSS v3.1 base score of 8.8 (High), reflecting network accessibility with no privileges required but requiring user interaction (Mozilla Advisory).

The root cause (CWE-416: Use After Free) lies in how Firefox's DisplayPortUtils::ShouldAsyncScrollWithAnchor function handles a reference to an entry in the AsyncScrollsWithAnchorHashmap hash table. Specifically, the code obtains a reference to a hash table entry and then calls ShouldAsyncScrollWithAnchorNotCached, which walks the frame tree and can modify the same hash table with a different frame as the key — invalidating the previously held reference and creating a dangling pointer condition. This is triggered when many anchor-positioned elements are moved simultaneously, such as through a chain of CSS anchor-positioned popups being dragged by a user (Mozilla Bugzilla). The fix involves performing two separate hash table lookups rather than holding a reference across a potentially mutating call (Mozilla Bugzilla).

Successful exploitation can result in memory corruption leading to arbitrary code execution, application crashes (tab crashes), or unauthorized access to sensitive data. Because no privileges are required and the attack is network-delivered via a malicious web page, an attacker could compromise the confidentiality, integrity, and availability of the affected system. Android versions of Firefox are also affected, broadening the potential attack surface (Mozilla Advisory, Mozilla Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. However, Mozilla's own security team noted that an exploit could be constructed relatively easily once the patch is analyzed, as the issue is straightforwardly triggered by chained anchor-positioned elements (Mozilla Bugzilla). The EPSS score is approximately 0.031% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft a malicious web page: Create an HTML/CSS page that uses a large number of CSS anchor-positioned elements arranged in a chain (e.g., multiple position-anchor linked popups or draggable elements).
2. Host the page: Serve the crafted page from an attacker-controlled web server accessible to the target.
3. Lure the victim: Use phishing, malvertising, or a drive-by link to direct a Firefox user (running a version prior to 147.0.2) to the malicious page.
4. Trigger user interaction: Prompt or wait for the user to interact with the anchor-positioned elements (e.g., click and drag a popup), causing Firefox to repeatedly call ShouldAsyncScrollWithAnchor while modifying the hash table.
5. Trigger the UAF: The hash table reference is invalidated mid-use, causing a use-after-free memory corruption condition, which can result in a tab crash or, with further exploitation primitives, arbitrary code execution (Mozilla Bugzilla).

• Process: Firefox renderer/content process crashes (tab crashes) with crash signature [@ mozilla::DisplayPortUtils::ShouldAsyncScrollWithAnchor].
• Logs: Firefox crash reports referencing DisplayPortUtils.cpp or ShouldAsyncScrollWithAnchor in the stack trace; crash IDs submitted to Mozilla's crash-stats system.
• Network: Unexpected outbound connections from the Firefox process following interaction with a web page containing many CSS anchor-positioned elements.
• File System: Unexpected files written by the Firefox process (e.g., shell scripts, executables) if code execution is achieved post-exploitation.

Mozilla has released Firefox 147.0.2 and Firefox 148, both of which contain the fix for this vulnerability. Firefox ESR 115 and ESR 140 are unaffected. Users should update Firefox to version 147.0.2 or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Organizations unable to patch immediately should consider restricting access to untrusted websites on critical systems until the update is deployed (Mozilla Advisory, Mozilla Bugzilla).

The vulnerability was noted by security aggregators including TheHackerWire on Mastodon, Bluesky, and their website shortly after disclosure. It was also included in Hawk-Eye's weekly threat landscape digest for Week 6 of 2026. Detection plugins were published by Tenable (Nessus plugin 297406) and Qualys (detection ID 386421), indicating prompt uptake by the vulnerability management community. No major vendor statements beyond Mozilla's own advisory have been identified.