CVE-2026-2778: 
NixOS vulnerability analysis and mitigation

CVE-2026-2778 is a sandbox escape vulnerability caused by incorrect boundary conditions in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. Specifically, it involves an out-of-bounds heap read in StructuredCloneBlob::Holder::ReadStructuredCloneInternal triggered by a crafted blobCount value in a StructuredClone buffer. The vulnerability was reported by Sajeeb Lohani, disclosed on February 24, 2026, and affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird ESR < 140.8. It carries a CVSS v3.1 base score of 10.0 (Critical) (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15, Feedly).

The root cause is an improper restriction of operations within the bounds of a memory buffer (CWE-119) in StructuredCloneBlob.cpp. The function ReadStructuredCloneInternal reads attacker-controlled blobOffset and blobCount values from a StructuredClone buffer and passes them directly to BlobImpls().AppendElements(&aHolder->BlobImpls()[blobOffset], blobCount). This overload accepts a raw C-style pointer and a length, copying blobCount elements without validating that blobOffset + blobCount stays within the bounds of the source array. Additionally, SCTAG_DOM_STRUCTURED_CLONE_HOLDER in StructuredCloneHolder.cpp lacks a CloneScope() == SameProcess guard, making it reachable from cross-process (IPC) scope — meaning a compromised content process can send a crafted IPC message to the parent process. With 1 blob in the IPC message and blobCount=100, the code reads 99 elements past the end of the array; each 8-byte OOB value is treated as a RefPtr, and AddRef() is called on garbage heap pointers, enabling heap memory disclosure and potential control-flow hijacking (Mozilla Bugzilla).

Successful exploitation allows a compromised content process to escape the browser sandbox and gain access to the host system with elevated privileges, enabling arbitrary code execution outside the browser's security boundary. The vulnerability has a changed scope (CVSS S:C), meaning its impact extends beyond the vulnerable component to the underlying operating system. Confidentiality, integrity, and availability are all rated High, as an attacker could read sensitive memory, corrupt data, or execute arbitrary code on the host. Android is also confirmed affected (Mozilla Bugzilla, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack vector is network-accessible, requires no privileges and no user interaction, and the bug reporter noted the problem is "kind of obvious in hindsight," suggesting that a motivated attacker with a pre-existing content process compromise could construct an exploit with moderate effort (Mozilla Bugzilla).

1. Gain content process execution: Exploit a separate renderer-level vulnerability (e.g., a JavaScript engine bug) to achieve code execution within Firefox's sandboxed content process — this is a prerequisite for exploiting CVE-2026-2778.
2. Craft a malicious StructuredClone buffer: From within the compromised content process, construct a StructuredClone IPC message containing a SCTAG_DOM_STRUCTURED_CLONE_HOLDER tag with a single blob but a crafted blobCount value (e.g., 100) far exceeding the actual number of blobs.
3. Send the IPC message to the parent process: Invoke ContentParent::RecvAsyncMessage or equivalent IPC mechanism to deliver the crafted StructuredClone buffer to the privileged parent process.
4. Trigger OOB heap read: The parent process's ReadStructuredCloneInternal reads blobOffset and blobCount from the attacker-controlled buffer and calls AppendElements with a raw pointer and the inflated count, reading memory beyond the allocated array.
5. Exploit heap contents: The OOB-read values are treated as RefPtr objects; AddRef() is called on each, dereferencing arbitrary heap addresses. With heap grooming, an attacker can place controlled data after the blob array to influence which pointers are dereferenced, potentially achieving arbitrary read/write primitives.
6. Achieve sandbox escape: Leverage the memory corruption to redirect execution flow in the parent process, escaping the sandbox and executing arbitrary code with the privileges of the Firefox parent process (Mozilla Bugzilla).

• Process: Unexpected child processes spawned by the Firefox or Thunderbird parent process (e.g., cmd.exe, /bin/sh, powershell.exe) that are not typical browser subprocesses.
• Logs: Browser crash reports or ASAN logs referencing heap-buffer-overflow in nsTArray_Impl::AppendElementsInternal or StructuredCloneBlob.cpp; IPC-related errors in browser diagnostic logs.
• Network: Unusual outbound connections from the Firefox/Thunderbird parent process to unexpected external hosts, particularly following browsing activity on untrusted sites.
• File System: Unexpected files written to disk by the browser parent process outside of normal profile directories; new executables or scripts created in temp directories by browser processes.

Mozilla has released patches addressing this vulnerability in the following versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. The fix replaces the unsafe raw-pointer AppendElements call with a bounds-checked mozilla::Span-based approach (AppendElements(Span(array1).Subspan(x, y))), and adds a CloneScope() == SameProcess guard for SCTAG_DOM_STRUCTURED_CLONE_HOLDER. No configuration-based workaround is available; immediate upgrade to a patched version is the only effective remediation. Enterprise administrators should prioritize deployment given the Critical CVSS score and sandbox-escape nature of the flaw (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15, Mozilla Bugzilla).

Mozilla awarded a security bounty to the reporter (Sajeeb Lohani) via their client bug bounty program, indicating the issue was considered significant. The Mozilla developer who triaged the bug (Andrew McCreight) initially expressed skepticism about the severity but confirmed it as a valid sandbox escape after reproducing an ASan crash, noting it was "kind of an obvious problem in hindsight." Multiple Linux distribution vendors (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, Amazon Linux) issued downstream advisories and package updates shortly after Mozilla's disclosure, reflecting broad ecosystem attention to the patch (Mozilla Bugzilla).