CVE-2026-2773: 
NixOS vulnerability analysis and mitigation

CVE-2026-2773 is a memory safety vulnerability caused by incorrect boundary conditions in the Web Audio component of Mozilla Firefox and Thunderbird. It affects Firefox versions before 148, Firefox ESR versions before 115.33 and before 140.8, Thunderbird versions before 148, and Thunderbird ESR versions before 140.8. The vulnerability was disclosed on February 24, 2026, as part of Mozilla's coordinated security advisory release. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15).

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), stemming from incorrect boundary condition checks within Firefox's Web Audio processing component. An attacker can exploit this flaw by delivering malicious Web Audio API content — such as a crafted webpage or HTML email — that triggers out-of-bounds memory operations. The attack vector is network-based, requires no privileges and no user interaction beyond visiting a malicious page, and the scope is unchanged. The vulnerability was discovered by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic, and is tracked internally as Bugzilla bug 2014832 (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-14).

Successful exploitation of CVE-2026-2773 can result in high impacts to confidentiality, integrity, and availability, potentially enabling arbitrary code execution in the context of the browser process. An attacker who exploits this vulnerability could read sensitive data from browser memory, corrupt memory to alter application behavior, or crash the browser entirely. Given the browser's access to session tokens, saved credentials, and local file system interactions, exploitation could serve as a foothold for further lateral movement or data exfiltration (Mozilla Advisory mfsa2026-15, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. However, the critical CVSS score of 9.8 and the network-accessible, no-interaction-required attack vector make this a high-priority patching target.

Mozilla has released patches addressing CVE-2026-2773 in the following versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should immediately update all affected Firefox and Thunderbird installations to these patched versions. No configuration-based workaround is available; upgrading is the only effective remediation. Enterprise administrators should leverage browser update policies (e.g., Group Policy, MDM) to ensure rapid deployment across managed endpoints (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-14, Mozilla Advisory mfsa2026-15).

The vulnerability was part of a large batch of security fixes released by Mozilla on February 24, 2026, covering dozens of high-severity issues across Firefox and Thunderbird. Notably, several of the vulnerabilities in this release — including CVE-2026-2773 — were discovered using AI assistance (Claude from Anthropic), which drew attention from the security community as an example of AI-assisted vulnerability research. Downstream Linux distributions including Red Hat, Debian, SUSE, Slackware, AlmaLinux, Rocky Linux, and Oracle Linux issued their own advisories and package updates shortly after Mozilla's disclosure (Mozilla Advisory mfsa2026-13, VulnCheck Blog).