CVE-2026-2763: 
NixOS vulnerability analysis and mitigation

CVE-2026-2763 is a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox and Thunderbird. It affects Firefox versions prior to 148, Firefox ESR versions prior to 115.33 and 140.8, Thunderbird versions prior to 148, and Thunderbird ESR prior to 140.8. The vulnerability was disclosed on February 24, 2026, via Mozilla Security Advisories MFSA2026-13, MFSA2026-14, and MFSA2026-15. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-15, Feedly).

The vulnerability is classified as CWE-416 (Use After Free), occurring within Firefox's JavaScript Engine component (Bugzilla bug 2012018). A use-after-free flaw arises when the engine accesses memory that has already been freed, potentially allowing an attacker to control the freed memory region and redirect execution flow. The vulnerability is exploitable over the network with no authentication, no privileges required, and no user interaction needed, making it particularly severe. It was discovered by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger, who used Claude from Anthropic as part of their research process (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14).

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code with the same privileges as the affected browser or email client process, potentially leading to complete system compromise. All three CIA triad dimensions are affected at a high level — confidentiality, integrity, and availability — enabling unauthorized data access, data modification, and service disruption. Given that Firefox and Thunderbird are widely deployed end-user applications, exploitation could serve as an initial access vector for broader network compromise or credential theft (Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the critical CVSS score and zero-interaction attack vector make it a high-priority target for future weaponization.

Mozilla has released patches addressing this vulnerability. Users should upgrade to Firefox 148 or later, Firefox ESR 115.33 or later, Firefox ESR 140.8 or later, Thunderbird 148 or later, or Thunderbird ESR 140.8 or later. Organizations unable to patch immediately should restrict user access to untrusted or unknown websites and monitor for anomalous JavaScript activity. Downstream Linux distributions including Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, and Amazon Linux have also released updated packages (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The vulnerability was notably discovered using Claude, an AI assistant from Anthropic, as part of a collaborative security research effort — a detail that attracted attention in the security community and was highlighted in a VulnCheck blog post (VulnCheck Blog). Multiple downstream vendors including Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle, and Amazon Linux rapidly issued their own security advisories and updated packages following Mozilla's disclosure. The broader patch batch (MFSA2026-13 through MFSA2026-17) addressed a large number of high-severity vulnerabilities simultaneously, reflecting a significant security release cycle for Mozilla products.