CVE-2026-2775: 
NixOS vulnerability analysis and mitigation

CVE-2026-2775 is a mitigation bypass vulnerability in the DOM: HTML Parser component of Mozilla Firefox and Thunderbird. It was discovered and reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic, and was publicly disclosed on February 24, 2026. Affected products include Firefox before 148, Firefox ESR before 115.33, Firefox ESR before 140.8 (for versions 128.0+), Thunderbird before 148, and Thunderbird ESR before 140.8. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Feedly).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and resides in the DOM: HTML Parser component of Firefox and Thunderbird. It allows an attacker to bypass existing security mitigations through a network-based attack vector requiring no privileges and no user interaction, making it exploitable remotely and silently. The underlying bug is tracked as Bugzilla bug 2015199, though the full technical details remain restricted. The vulnerability was identified through AI-assisted security research using Anthropic's Claude model (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14).

Successful exploitation of CVE-2026-2775 can result in high-impact breaches across confidentiality, integrity, and availability, as reflected in its CVSS 9.8 score. By bypassing security mitigations in the HTML Parser, an attacker could potentially circumvent browser security controls, enabling further exploitation of the affected system — including data exfiltration, code execution, or chaining with other vulnerabilities for sandbox escape or privilege escalation. All users running unpatched versions of Firefox or Thunderbird across desktop platforms are within the affected asset scope (Feedly, Mozilla Advisory MFSA2026-13).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2026-2775. The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Feedly).

Mozilla has released patched versions addressing CVE-2026-2775: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations and individual users should update to these versions immediately, given the critical CVSS score and network-based, no-interaction-required attack vector. Downstream Linux distributions including Debian, SUSE, Red Hat, AlmaLinux, Rocky Linux, Oracle Linux, and Amazon Linux 2 have also released updated packages. No configuration-based workarounds are known; upgrading is the only recommended remediation (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14, Mozilla Advisory MFSA2026-15).

The vulnerability was notably discovered using AI-assisted security research — specifically, a team of researchers leveraging Anthropic's Claude model — which drew attention in the security community as an example of AI-aided vulnerability discovery at scale. VulnCheck published a blog post discussing CVEs credited to Anthropic, highlighting this research methodology (VulnCheck Blog). Multiple Linux distribution vendors (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux) rapidly issued security advisories and updated packages following Mozilla's disclosure, reflecting broad ecosystem response to the critical severity rating.