CVE-2026-2767: 
NixOS vulnerability analysis and mitigation

CVE-2026-2767 is a use-after-free vulnerability in the JavaScript/WebAssembly component of Mozilla Firefox and Thunderbird, specifically in SpiderMonkey's baseline compiler for WebAssembly GC array.fill operations. Discovered and reported by security researcher Sajeeb Lohani, it was publicly disclosed on February 24, 2026. Affected products include Firefox prior to version 148, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird ESR prior to 140.8. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The root cause is a missing pre-write barrier in the baseline compiler's emitArrayFill() function in WasmBaselineCompile.cpp (lines 8816–8817), classified as CWE-416 (Use After Free). SpiderMonkey's incremental garbage collector uses a snapshot-at-the-beginning tricolor invariant: when a reference-typed field is overwritten, a pre-write barrier must inform the GC of the old value before it is lost. The baseline compiler's array.fill implementation incorrectly used PreBarrierKind::None instead of PreBarrierKind::Normal, meaning the GC was not notified when existing live references in a WasmGC array were overwritten. This allowed the GC to prematurely collect a live object (the "victim"), leaving dangling references that could be accessed after the memory was freed and reallocated. The Ion compiler's array.fill and the baseline compiler's array.set both correctly used the normal pre-barrier; the omission was specific to baseline array.fill introduced in Bug 1851864 (commit ca4c7a8b7621, 2023-09-26). The bug is reachable from web content via WasmGC, enabled by default since Firefox 120 (Mozilla Bugzilla).

Successful exploitation can result in complete compromise of the affected Firefox or Thunderbird content process, with high impact to confidentiality, integrity, and availability. An attacker who achieves use-after-free can read from or write to freed heap memory, enabling potential remote code execution within the browser's content process sandbox. This could allow unauthorized access to sensitive data displayed in the browser, modification of in-memory data structures, or application crash. Further exploitation via heap grooming could serve as a stepping stone toward sandbox escape when chained with other vulnerabilities (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported as of the disclosure date (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a low current probability of exploitation in the wild. Mozilla's internal assessment noted that exploitation would be "relatively difficult" due to the need for precise GC timing control and heap grooming, and the bug only affects the baseline compilation tier (before Ion tier-up occurs). A PoC script was included in the original bug report to demonstrate the invariant violation using debug shell GC APIs, but it was not reliably reproducible as a crash without specific GC slice timing (Mozilla Bugzilla).

1. Craft malicious WebAssembly module: Create a WasmGC module defining reference-typed arrays ((array (mut anyref))), struct types for victim and holder objects, and an array.fill function that overwrites reference-typed slots with null.
2. Trigger baseline compilation: Ensure the target function executes in the baseline tier (before Ion tier-up). In web content, baseline is the initial compilation tier for the first several thousand invocations.
3. Allocate and tenure victim objects: Create a victim WasmGC struct and populate all slots of a reference-typed array with references to it. Trigger a full GC to tenure the objects into the old generation heap.
4. Drop JS-side references: Remove all JavaScript-side references to the victim object so it is only reachable via the WasmGC array slots.
5. Initiate incremental GC: Apply allocation pressure (e.g., allocate many short-lived objects) to trigger an incremental GC cycle. Wait for the GC to partially mark the heap, with the holder object already scanned (marked black) but the array not yet scanned.
6. Trigger the bug via array.fill: Call the exported triggerBug function: read the victim from the array, store it into the holder struct (creating a black→white edge), then call array.fill with null to overwrite all array slots. Because the pre-barrier is missing, the GC is not informed of the overwritten references.
7. Complete GC cycle: Allow the GC to finish. If the array was the last scanned source of references to the victim and the holder was already black, the GC may collect the victim as garbage.
8. Heap grooming and UAF access: Allocate replacement objects to occupy the freed memory. Access holder.field0 — it now points to freed/reused memory, yielding corrupted data or a crash, which can be leveraged for further exploitation (Mozilla Bugzilla).

• Process: Unexpected crashes or hangs of the Firefox or Thunderbird content process (firefox, firefox-bin, thunderbird) potentially accompanied by crash reports referencing WebAssembly or GC-related stack frames.
• Logs: Browser crash reports or minidumps referencing WasmBaselineCompile.cpp, emitArrayFill, or SpiderMonkey GC verifier assertion failures such as [barrier verifier] Unmarked edge.
• Network: Delivery of WebAssembly (.wasm) payloads from untrusted or unexpected origins, particularly those defining WasmGC array types with array.fill instructions targeting reference-typed elements.
• File System: Unexpected crash dump files (.dmp, minidump) generated in the Firefox profile directory or system temp folder following visits to untrusted web content.

Mozilla has released patches addressing this vulnerability in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should immediately upgrade all affected installations to these minimum versions. No configuration-based workaround is available for production use; disabling WebAssembly entirely would mitigate the risk but is not practical for most deployments. Prioritize patching systems where Firefox or Thunderbird is exposed to untrusted web content or email (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

Mozilla awarded a security bounty to the reporter, Sajeeb Lohani, and classified the vulnerability as sec-high internally. The bug was also flagged with the ai-involved keyword, noting AI assistance in the research process. Multiple Linux distribution vendors (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, Amazon Linux) issued downstream security advisories and updated packages shortly after Mozilla's disclosure. Vulnerability scanners including Nessus and Qualys added detection plugins within days of the advisory (Mozilla Bugzilla).