CVE-2026-2758: 
NixOS vulnerability analysis and mitigation

CVE-2026-2758 is a use-after-free vulnerability in the JavaScript Garbage Collection (GC) component of Mozilla Firefox and Thunderbird, specifically within the js::gc::PreWriteBarrierImpl function in SpiderMonkey's hash table implementation. It was discovered by security researcher Gary Kwong and disclosed on February 24, 2026, alongside Mozilla's security advisories MFSA2026-13, MFSA2026-14, and MFSA2026-15. Affected products include Firefox before 148, Firefox ESR before 115.33, Firefox ESR before 140.8, Thunderbird before 148, and Thunderbird ESR before 140.8. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Feedly).

The root cause is a use-after-free condition (CWE-416) in Mozilla's mfbt/HashTable.h, specifically triggered when move assignment is performed on a hash table entry that has already been destroyed via HashTableEntry::destroyStoredT(). The flaw was introduced by a regression in Bug 1269319 and made more easily triggerable by changes in Bug 1827612, which replaced post-barriers for WeakMap keys with PreBarriered pointers. When a non-live hash table entry is assigned using move semantics, GC barrier wrappers (such as js::gc::PreWriteBarrierImpl) operate on invalid object state, leading to a crash or potential memory corruption. The fix replaces the move assignment with placement new to construct a fresh entry in place, avoiding the invalid barrier call. Exploitation requires precisely timed out-of-memory (OOM) conditions and garbage collection cycles, making it difficult to trigger reliably from a web page without low-level control (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code in the context of the browser process, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system. Because the vulnerability resides in the JavaScript engine's garbage collector, it affects all platforms where Firefox or Thunderbird runs, including Android. In a worst-case scenario, an attacker could leverage this to escape the browser sandbox (in combination with other vulnerabilities), steal sensitive data, or install malware (Mozilla Advisory MFSA2026-13, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). Mozilla's internal assessment notes that exploitation is "very difficult" as it requires precisely timed OOM and GC conditions, and is most easily triggered via jsshell testing functions rather than from a standard web page (Mozilla Bugzilla). The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8, all published on February 24, 2026. Organizations should immediately update all affected installations to these versions or later. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize deployment across all endpoints given the critical CVSS score, even though active exploitation has not been observed. Linux distribution vendors including Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, and Amazon Linux have also released updated packages (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14, Mozilla Advisory MFSA2026-15).

Mozilla awarded a security bug bounty for this vulnerability, indicating recognition of its significance. The bug was rated sec-high internally and received priority uplift approval for all supported ESR branches. Community discussion on Bugzilla noted that while the underlying flaw dates back to Bug 1269319 (Firefox 49 era), it became more practically triggerable with the WeakMap changes introduced in Bug 1827612. No significant broader media coverage or notable social media reactions specific to this CVE were identified beyond standard Linux distribution security advisories (Mozilla Bugzilla).