CVE-2026-2776: 
NixOS vulnerability analysis and mitigation

CVE-2026-2776 is a sandbox escape vulnerability caused by incorrect boundary conditions (out-of-bounds heap write/read) in the Telemetry component of Firefox and Thunderbird, specifically within the CombinedStacks::AddStacks() function on Windows. It was discovered by security researcher Sajeeb Lohani and disclosed on February 24, 2026, alongside Mozilla security advisories MFSA2026-13, MFSA2026-14, and MFSA2026-15. Affected versions include Firefox before 148, Firefox ESR before 115.33, Firefox ESR before 140.8, Thunderbird before 148, and Thunderbird ESR before 140.8. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) (Mozilla Advisory MFSA2026-15, Mozilla Advisory MFSA2026-13).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability exists in CombinedStacks::AddStacks() at toolkit/components/telemetry/other/CombinedStacks.cpp (lines 76–94), where an attacker-controlled mNextIndex value — deserialized from an IPC message without cross-validation — is used to index into mStacks via std::vector::operator[], which performs no bounds checking in release builds on Windows. This enables three attack vectors: (1) an OOB heap write via mStacks[index].clear() when mNextIndex exceeds the actual vector size, (2) an OOB heap read of frame data from aStacks.mModules[frame.mModIndex] using an attacker-controlled uint16_t index, and (3) a division-by-zero if mMaxStacksCount is set to zero. The exploit path runs from a compromised content process to the parent process via the GetUntrustedModulesData IPC mechanism: a second IPC response for the same (pid, type) key triggers Merge(), which calls AddStacks() with the malicious CombinedStacks object. This vulnerability is Windows-only, as the entire infrastructure is gated behind #if defined(XP_WIN) (Mozilla Bugzilla).

Successful exploitation allows a compromised Firefox or Thunderbird content process to escape the browser sandbox and execute arbitrary code in the parent (privileged) process on Windows systems. This results in full compromise of confidentiality, integrity, and availability of the affected host — an attacker can read parent process memory (including sensitive user data), corrupt heap structures, or crash the browser via division-by-zero. Because the exploit operates from within an already-compromised content process, it is typically chained with a separate renderer exploit to achieve full remote code execution from a malicious web page or email (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the bug report notes that given a compromised content process, triggering the OOB heap write/read is relatively straightforward, and the trigger condition (loading about:third-party twice) is reliable due to attacker-controlled mProcessType and mPid fields (Mozilla Bugzilla).

1. Achieve content process compromise: Exploit a separate renderer vulnerability (e.g., a use-after-free or type confusion in the JavaScript engine) to gain arbitrary code execution within a Firefox or Thunderbird content process on Windows.
2. Identify the IPC trigger condition: Cause the parent process to call GetUntrustedModuleLoadEvents() at least twice before staging is cleared — for example, by loading and reloading about:third-party, which uses the KEEP_LOADEVENTS_NEW flag that skips SettleAllStagingData().
3. Craft malicious IPC response: From the compromised content process, respond to SendGetUntrustedModulesData() with a crafted UntrustedModulesData object containing a malicious CombinedStacks where mStacks.size()=1, mNextIndex is set to a large value (e.g., 49), and mMaxStacksCount=50. The four fields are deserialized independently with no cross-validation.
4. Trigger the second Merge path: Send a second IPC response for the same (pid, type) key. The first response is safely Insert()-ed; the second triggers Merge() → mStacks.AddStacks(newData.mStacks) in UntrustedModulesData.cpp.
5. Achieve OOB heap write/read: AddStacks() resizes mStacks to min(1+1, 50)=2, then accesses mStacks[49].clear() — writing 47 elements (1128 bytes) past the end of the 2-element allocation. Simultaneously, attacker-controlled mModIndex values enable OOB reads of parent process heap memory.
6. Leverage heap corruption for sandbox escape: Use the OOB write to corrupt adjacent heap metadata or data structures in the parent process, enabling further exploitation to achieve arbitrary code execution outside the sandbox (Mozilla Bugzilla).

• Process: Unusual child processes spawned by the Firefox or Thunderbird parent process (e.g., cmd.exe, powershell.exe) on Windows, particularly following browser activity on about:third-party.
• Logs: Browser crash reports or Windows Event Log entries indicating heap corruption or access violations originating from XUL.dll in the context of telemetry IPC handling.
• Network: Unexpected outbound network connections from the Firefox/Thunderbird parent process to unknown external hosts, which may indicate post-exploitation activity.
• File System: Unexpected files written to disk by the Firefox or Thunderbird parent process, particularly in user profile directories or temporary folders, following browser use.

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users and administrators should update immediately to one of these versions. No configuration-based workaround is available, as the vulnerable code path is part of the Windows-only Telemetry IPC infrastructure. Enterprise administrators unable to patch immediately should consider restricting Firefox and Thunderbird usage or deploying application controls to limit exposure (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14, Mozilla Advisory MFSA2026-15).

The vulnerability was reported by external researcher Sajeeb Lohani through Mozilla's bug bounty program and was awarded a security bounty (sec-bounty+). Mozilla's security team (Daniel Veditz) assessed it as a plausible sandbox escape and prioritized it as P1/S2, opting for a fast patch-to-release cycle rather than obfuscation. The fix was described as straightforward — adding bounds checks before use of mNextIndex and mMaxStacksCount in AddStacks(). Multiple Linux distribution vendors (Red Hat, Debian, SUSE, Slackware, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux) issued downstream advisories and package updates shortly after Mozilla's disclosure (Mozilla Bugzilla).