CVE-2026-2768: 
NixOS vulnerability analysis and mitigation

CVE-2026-2768 is a sandbox escape vulnerability in the Storage: IndexedDB component of Mozilla Firefox and Thunderbird, allowing a compromised content process to achieve an arbitrary relative heap write in the parent process. It was discovered by security researcher Sajeeb Lohani and publicly disclosed on February 24, 2026, as part of Mozilla's coordinated release of Firefox 148 and Firefox ESR 140.8. Affected versions include Firefox below 148, Firefox ESR below 140.8, Thunderbird below 148, and Thunderbird ESR below 140.8. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Feedly).

The root cause is improper access control and protection mechanism failure (CWE-284, CWE-693) in the IPC deserialization of the IndexedDB Key class. In dom/indexedDB/SerializationHelpers.h (lines 36–39), the mAutoIncrementKeyOffsets array is deserialized from IPC messages without any bounds validation against the associated mBuffer length. A compromised content process can forge an ObjectStoreAddParams IPC message containing a Key with a small mBuffer (e.g., 4 bytes) and an arbitrarily large mAutoIncrementKeyOffsets value (e.g., 0x1000). When the parent process calls Key::MaybeUpdateAutoIncrementKey in ActorsParent.cpp during DoDatabaseWork, it writes 8 bytes at mBuffer.Data() + target_offset with no bounds check, enabling an arbitrary relative heap write in the unsandboxed parent process. Additionally, VerifyRequestParams in ActorsParent.cpp never validates mAutoIncrementKeyOffsets, and an inverted aTrustParams condition in AllocCursor causes cross-process content callers to skip key range validation entirely (Mozilla Bugzilla).

Successful exploitation allows a compromised content process to escape the Firefox sandbox by corrupting arbitrary heap memory in the parent process, which is not sandboxed on many platforms. This can lead to full compromise of the host system, including unauthorized access to sensitive data (high confidentiality impact), modification of system integrity (high integrity impact), and disruption of availability (high availability impact). The changed scope means the impact extends beyond the browser sandbox to the underlying operating system, enabling potential lateral movement or persistent access (Mozilla Advisory MFSA2026-13, Feedly).

Exploitation requires a pre-compromised content process (e.g., via a separate browser vulnerability), making it a second-stage attack primitive rather than a standalone remote exploit. No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.018% (0.000180), reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is network-based with low complexity and requires no user interaction or privileges once the content process is compromised, per the CVSS scoring (Mozilla Bugzilla).

1. Gain content process compromise: Exploit a separate browser vulnerability (e.g., a JavaScript engine bug) to achieve code execution within a Firefox content process sandbox.
2. Set up IndexedDB environment: Using normal web APIs from the compromised content process, open an IndexedDB database with an auto-increment object store that has at least one index (e.g., store.createIndex('idx_a', 'a')).
3. Forge a malicious IPC message: Craft an ObjectStoreAddParams IPC message containing a Key object with a small mBuffer (e.g., 4 bytes: "AAAA") and a large, attacker-controlled mAutoIncrementKeyOffsets value (e.g., [0x1000]) using ParamTraits serialization.
4. Send the forged message to the parent process: Transmit the crafted IPC message. The parent process deserializes the Key via ParamTraits<Key>::Read in SerializationHelpers.h without validating offsets against buffer bounds, and VerifyRequestParams does not check mAutoIncrementKeyOffsets.
5. Trigger the OOB write: The parent process calls Key::MaybeUpdateAutoIncrementKey during DoDatabaseWork, writing 8 bytes (the IEEE 754 encoding of the auto-increment counter value, e.g., 0xBFF0000000000000 for counter=1) at mBuffer.Data() + 0x1000, corrupting arbitrary heap memory in the parent process.
6. Achieve sandbox escape: Leverage the heap corruption primitive (fully controlled offset, 8-byte write per IPC message, multiple offsets possible) to overwrite security-critical data structures, function pointers, or vtables in the parent process to gain arbitrary code execution outside the sandbox (Mozilla Bugzilla).

• Process: Unusual child processes spawned by the Firefox parent process (e.g., cmd.exe, /bin/sh, powershell.exe) that are not typical browser subprocesses.
• Logs: Crash reports or ASAN logs referencing heap-buffer-overflow WRITE of size 8 in Key::MaybeUpdateAutoIncrementKey or Key::WriteDoubleToUint64 in Firefox/Thunderbird crash telemetry.
• Network: Unexpected outbound connections from the Firefox/Thunderbird parent process to external IPs, particularly shortly after IndexedDB activity.
• File System: Unexpected files written to disk by the Firefox parent process outside of its normal profile directories; new scheduled tasks or persistence mechanisms created under the browser's user account.
• Memory: ASAN or heap-monitoring tools reporting out-of-bounds writes originating from dom/indexedDB/Key.cpp around the MaybeUpdateAutoIncrementKey function.

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should immediately update all affected installations to these minimum versions. No configuration-based workaround is available; upgrading is the only remediation. Downstream Linux distributions (Red Hat, Debian, SUSE, Rocky Linux, AlmaLinux, Oracle Linux, Slackware, Amazon Linux) have also released updated packages (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The vulnerability was reported by security researcher Sajeeb Lohani and received a Mozilla security bounty. Mozilla classified it as sec-high and awarded a client bug bounty. Coverage appeared in security-focused outlets such as CyberInsider, which noted the sandbox escape fixes alongside Firefox 148's new AI kill-switch feature. The bug was also flagged with the ai-involved keyword in Mozilla's Bugzilla, indicating AI tooling was used in some aspect of the research or triage process (Mozilla Bugzilla, CyberInsider).