CVE-2026-2762: 
NixOS vulnerability analysis and mitigation

CVE-2026-2762 is an integer overflow vulnerability in the JavaScript Standard Library component (EncodeForRegExpEscape) of Mozilla Firefox and Thunderbird, affecting 32-bit builds only. It was discovered and reported by André Bargull, disclosed on February 24, 2026, and fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The root cause is a CWE-190 (Integer Overflow or Wraparound) in the EncodeForRegExpEscape function within js/src/builtin/RegExp.cpp. On 32-bit builds, the output length computation for RegExp.escape() uses a plain size_t, which overflows when processing very large strings — for example, RegExp.escape("\udf00".repeat(0x2AAAAAAB)) causes 0x2AAAAAAB * 6 to wrap around to just 2. The code then calls StringBuilder::reserve(2) but subsequently writes the full (much larger) number of characters into that 2-byte buffer, resulting in an out-of-bounds write into the js::StringBufferArena malloc arena. The fix replaced the plain size_t with mozilla::CheckedInt to detect and handle the overflow safely. 64-bit builds are not affected. (Mozilla Bugzilla #2011649)

Successful exploitation enables an out-of-bounds memory write into the js::StringBufferArena malloc arena, which can lead to memory corruption and potentially arbitrary code execution in the context of the browser or email client process. The CVSS score reflects high impact to confidentiality, integrity, and availability, meaning an attacker could compromise the affected system, exfiltrate data, or disrupt services. Because the vulnerability is triggered via JavaScript execution, it is exploitable through malicious web pages or email content rendered by Thunderbird, affecting any user running a 32-bit build of the affected products (Mozilla Advisory MFSA2026-13, Mozilla Bugzilla #2011649).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. While the bug reporter noted that an attacker could infer the nature of the fix from the patch (replacing size_t with mozilla::CheckedInt), constructing a reliable exploit to achieve code execution after the initial memory corruption would require additional research (Mozilla Bugzilla #2011649).

1. Identify target: Confirm the target is running a 32-bit build of Firefox (< 148 or ESR < 140.8) or Thunderbird (< 148 or ESR < 140.8), as 64-bit builds are not affected.
2. Craft malicious JavaScript: Prepare a JavaScript payload that calls RegExp.escape() with a sufficiently large string to trigger the integer overflow — e.g., RegExp.escape("\udf00".repeat(0x2AAAAAAB)).
3. Deliver payload: Host the malicious JavaScript on a web page (for Firefox) or embed it in an HTML email (for Thunderbird) and lure the victim to visit/open it.
4. Trigger overflow: When the JavaScript engine processes the RegExp.escape() call, the output length computation overflows size_t on 32-bit platforms, causing StringBuilder::reserve() to allocate only 2 bytes.
5. Out-of-bounds write: The engine writes the full (much larger) string content into the undersized buffer, corrupting adjacent memory in the js::StringBufferArena malloc arena.
6. Achieve code execution: Leverage the memory corruption to gain control of execution flow, potentially enabling arbitrary code execution in the browser/email client process context (Mozilla Bugzilla #2011649).

Mozilla has released patches addressing this vulnerability. Users should upgrade to Firefox 148 or later, Firefox ESR 140.8 or later, Thunderbird 148 or later, or Thunderbird ESR 140.8 or later. No configuration-based workaround is available; upgrading is the only remediation. Organizations unable to patch immediately should consider restricting JavaScript execution in high-risk environments or blocking access to untrusted web content. Patch details are available in Mozilla Security Advisories MFSA2026-13, MFSA2026-15, MFSA2026-16, and MFSA2026-17 (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The vulnerability was reported by Mozilla community member André Bargull, who also developed the fix. Multiple Linux distributions (Debian, Red Hat, AlmaLinux, Rocky Linux, Oracle Linux, SUSE, Slackware, Amazon Linux) issued downstream security advisories and updated packages shortly after Mozilla's disclosure. Vulnerability tracking platforms including Tenable (Nessus) and Qualys added detection coverage within days of the advisory. No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified beyond standard patch notification coverage.