CVE-2026-2777: 
NixOS vulnerability analysis and mitigation

CVE-2026-2777 is a privilege escalation vulnerability in the Messaging System component of Mozilla Firefox and Thunderbird, specifically involving the AboutMessagePreviewParent IPC actor. Discovered by security researcher Richard Belisle and disclosed on February 24, 2026, the flaw allows a compromised content process to reach SpecialMessageActions.handleAction() without restriction, exposing 46 privileged actions including arbitrary WebExtension installation and homepage hijacking. Affected versions include Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Feedly).

The root cause is improper privilege management (CWE-269): the AboutMessagePreviewParent JSWindowActor registration in DesktopActorRegistry.sys.mjs lacked remoteTypes restrictions, unlike its sibling AboutWelcomeParent which correctly specifies remoteTypes: ["privilegedabout"]. This omission allows a compromised web content process to send IPC messages directly to AboutMessagePreviewParent, which dispatches them to SpecialMessageActions.handleAction() using SystemPrincipal — bypassing the normal site-permission doorhanger for addon installation. Additionally, the about:messagepreview page loads in the web remote type (same as attacker-controlled content), and the document URI check (IsHttpOrHttpsAndCrossOrigin()) returns false for about: URIs, enabling URI spoofing via RecvUpdateDocumentURI as an alternative exploitation path. A full PoC was developed and verified by the reporter using Marionette automation against Firefox ESR 140.7.0 and mozilla-central (Mozilla Bugzilla).

A compromised Firefox or Thunderbird content process can exploit this vulnerability to install arbitrary WebExtensions with SystemPrincipal (bypassing the "Allow this site to install?" doorhanger, requiring only one user click on an attacker-controlled infobar), or hijack the browser homepage via SET_PREF with a single social-engineered click. Beyond these two primary impacts, all 46 SpecialMessageActions action types are exposed, including DISABLE_DOH, PIN_FIREFOX_TO_TASKBAR, SET_DEFAULT_BROWSER, and MULTI_ACTION, enabling broad unauthorized configuration changes. This vulnerability is particularly dangerous as a second-stage payload following a content process compromise (e.g., via a renderer exploit), enabling privilege escalation from the sandboxed content process to browser-level privileges (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability requires a pre-existing content process compromise (e.g., via a separate renderer vulnerability) as a precondition, and the most impactful actions (addon install, homepage hijack) require one user click on a social-engineered infobar. The EPSS score is 0.000240 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Mozilla awarded a security bounty to the reporter, indicating the issue was treated as a legitimate high-severity finding (Mozilla Bugzilla).

1. Gain content process compromise: Exploit a separate renderer vulnerability (e.g., a use-after-free or JIT miscompilation in Firefox's JavaScript engine) to achieve arbitrary code execution within a Firefox web content process.
2. Navigate to about:messagepreview: From the compromised content process, call docShell.loadURI("about:messagepreview") — this page loads in the web remote type, the same as the attacker's content process, making it reachable.
3. Alternatively, spoof the document URI: Use RecvUpdateDocumentURI at the C++ IPC level to spoof the document URI to about:messagepreview without navigating, since IsHttpOrHttpsAndCrossOrigin() returns false for about: URIs and does not block the spoof.
4. Send privileged IPC message: From the content process, send a JSActor message to AboutMessagePreviewParent invoking MPShowMessage with a crafted message payload (e.g., an InfoBar with INSTALL_ADDON_FROM_URL or SET_PREF action), bypassing the remoteTypes check that is absent from this actor's registration.
5. Social engineer the user: The browser chrome displays a legitimate-looking InfoBar with attacker-controlled text (e.g., "A critical security update is available — click Add to install"). One user click triggers SpecialMessageActions.handleAction() with SystemPrincipal, installing the attacker's WebExtension without the normal site-permission doorhanger, or setting the homepage to an attacker-controlled URL (Mozilla Bugzilla).

• Process: Unexpected child processes or unusual activity spawned by the Firefox/Thunderbird parent process following content process compromise; Firefox processes communicating over IPC with about:messagepreview loaded in a web-type content process.
• Browser State: Unexpected WebExtension installations not initiated by the user; browser homepage (browser.startup.homepage preference) changed to an unknown or attacker-controlled URL; unexpected changes to preferences such as browser.newtabpage.activity-stream.asrouter.devtoolsEnabled.
• Logs: Firefox crash reports or telemetry indicating renderer exploits preceding unusual IPC activity; browser extension installation events in Firefox profile logs (extensions.json) for extensions not recognized by the user.
• File System: New or unrecognized extension directories appearing under the Firefox profile's extensions/ folder; modified prefs.js or user.js in the Firefox profile directory reflecting unauthorized preference changes (Mozilla Bugzilla).

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The fix adds remoteTypes: ["privilegedabout"] to the AboutMessagePreviewParent actor registration, disables the actor pair when the ASRouter admin pref is not enabled, and removes the hint that directed users to enable the developer pref. Upgrading to a patched version is the only recommended remediation; no configuration-based workaround is available for unpatched versions. Enterprise administrators should prioritize patching all Firefox and Thunderbird deployments, particularly those where users may encounter untrusted web content (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14, Mozilla Advisory MFSA2026-15).

Mozilla classified the vulnerability as "Impact: high" and awarded a security bounty to reporter Richard Belisle, reflecting the seriousness of the finding. The bug was tracked as Priority 1 / Severity 3 internally and uplifted to all supported branches (Firefox 148, ESR 115.33, ESR 140.8). Multiple Linux distribution vendors (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, Amazon Linux) issued security advisories and updated packages shortly after Mozilla's disclosure, indicating broad ecosystem response. Security scanning vendors including Tenable (Nessus) and Qualys added detection coverage within days of the advisory (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).