CVE-2026-2765: 
NixOS vulnerability analysis and mitigation

CVE-2026-2765 is a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox and Thunderbird. It affects Firefox versions prior to 148, Firefox ESR versions prior to 140.8, Thunderbird versions prior to 148, and Thunderbird ESR versions prior to 140.8. The vulnerability was disclosed on February 24, 2026, via Mozilla Security Advisories MFSA2026-13, MFSA2026-15, MFSA2026-16, and MFSA2026-17. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The vulnerability is classified as CWE-416 (Use After Free), occurring within Firefox and Thunderbird's JavaScript Engine component (Bugzilla bug 2013562). A use-after-free condition arises when the engine accesses memory that has already been freed, potentially allowing an attacker to control the freed memory region and redirect execution flow. The flaw was discovered by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic — a notable instance of AI-assisted vulnerability research. The attack vector is network-based, requires no privileges, and no user interaction, making it exploitable remotely against any user browsing a malicious page or receiving a crafted email in Thunderbird (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

Successful exploitation of CVE-2026-2765 can lead to arbitrary code execution within the context of the browser or email client process, resulting in high confidentiality, integrity, and availability impact. An attacker could leverage this to steal sensitive data, install malware, or pivot to other systems accessible from the victim's machine. The vulnerability is remotely exploitable without authentication or user interaction, meaning any user running an unpatched version of Firefox or Thunderbird is at risk simply by visiting a malicious website or opening a crafted message (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. Despite the absence of known exploitation, the critical CVSS score and zero-interaction attack vector make this a high-priority patching target.

Mozilla has released patches addressing CVE-2026-2765 in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should immediately upgrade all affected installations to these versions or later. No configuration-based workaround is available; upgrading is the only effective remediation. Enterprise administrators unable to patch immediately should consider restricting browser access via network controls and monitoring for anomalous browser process behavior (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15). Linux distribution vendors including Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, and Amazon Linux have also released updated packages.

This vulnerability is notable for being discovered using Claude, an AI assistant from Anthropic, as part of a collaborative research effort by a team of security researchers. The VulnCheck blog highlighted this as part of a broader discussion on Anthropic-credited CVEs, reflecting growing industry interest in AI-assisted vulnerability research (VulnCheck Blog). The vulnerability was part of a large batch of high-severity issues fixed in the Firefox 148 / ESR 140.8 release cycle, which attracted broad coverage from Linux security news outlets and vendor patch pipelines across major distributions.