CVE-2026-2782: 
NixOS vulnerability analysis and mitigation

CVE-2026-2782 is a prototype pollution vulnerability (classified as privilege escalation) in the Netmonitor component of Mozilla Firefox and Thunderbird. Discovered and reported by a researcher identified as "Cody," it was publicly disclosed on February 24, 2026, as part of Mozilla's coordinated security release. The vulnerability affects Firefox versions prior to 148, Firefox ESR versions prior to 140.8, Thunderbird versions prior to 148, and Thunderbird ESR versions prior to 140.8 (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15). Mozilla rates this vulnerability as moderate impact, while the NVD assigns a CVSS v3.1 base score of 9.8 (Critical) (Feedly).

The root cause is a prototype pollution vulnerability (CWE-269: Improper Privilege Management) in the getProperties() method within RequestPanel.js of the Firefox DevTools Netmonitor component. The vulnerable code uses a plain object literal {} as the accumulator in an Array.reduce() call when parsing HTTP form data parameters. When a form parameter is named __proto__, the lookup map["__proto__"] returns Object.prototype rather than undefined, bypassing the null check and causing the code to attempt calling Object.prototype.push() — a method that does not exist — resulting in a TypeError crash of the Network panel (Mozilla Bugzilla). The fix replaces the {} accumulator with Object.create(null) (a null-prototype object) and uses URLSearchParams for safer form data parsing, consistent with prior fixes applied to UrlPreview.js and CookiesPanel.js (Mozilla Bugzilla). Exploitation requires a victim developer to open Firefox DevTools, navigate to the Network tab, and inspect a crafted HTTP request containing a __proto__ parameter in its POST body.

Successful exploitation crashes the Firefox DevTools Network panel, constituting a denial-of-service condition for the developer tools environment. While Mozilla rates the impact as moderate (primarily a DevTools crash requiring user interaction with the Network panel), the NVD's CVSS score of 9.8 reflects the theoretical potential for prototype pollution to affect confidentiality, integrity, and availability of the browser environment. The practical impact is limited to users who actively use Firefox DevTools to inspect network traffic from attacker-controlled pages, and does not directly affect end users who do not open developer tools (Mozilla Advisory mfsa2026-13, Mozilla Bugzilla).

A proof-of-concept HTML file (poc.html) was submitted as part of the original bug report and is referenced in the Mozilla Bugzilla ticket, demonstrating the crash via a crafted fetch() request with __proto__=evil_value&normal=test as the POST body (Mozilla Bugzilla). There is no evidence of in-the-wild exploitation or threat actor attribution at this time (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a developer to actively inspect a malicious network request in DevTools, significantly limiting the attack surface.

1. Craft a malicious web page: Create an HTML page that sends a fetch() POST request with a body containing __proto__=evil_value&normal=test (URL-encoded form data with Content-Type: application/x-www-form-urlencoded).
2. Host the page: Serve the crafted HTML from an attacker-controlled web server accessible to the target developer.
3. Social engineer the target: Convince a developer using a vulnerable Firefox version (< 148 or ESR < 140.8) to visit the malicious page while Firefox DevTools is open.
4. Trigger the vulnerable code path: The developer must open the Network tab in DevTools and click on the captured POST request, then navigate to the "Request" tab/panel to view the form data.
5. Achieve crash: The getProperties() method in RequestPanel.js processes the __proto__ parameter, accesses Object.prototype, and attempts to call .push() on it, throwing a TypeError that crashes the Network panel (Mozilla Bugzilla).

• Network: Inbound HTTP POST requests to a web server with a body containing __proto__= as a form parameter (URL-encoded), potentially indicating an attacker testing or staging this exploit.
• Logs: Firefox DevTools console errors such as TypeError: map[obj.name].push is not a function originating from RequestPanel.js in the Netmonitor component; messages indicating "The Network panel has crashed."
• Process/Application: Unexpected crash or reset of the Firefox DevTools Network panel when inspecting a specific POST request; requirement to close and reopen the toolbox to restore functionality (Mozilla Bugzilla).

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8 (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15). Organizations should prioritize updating all Firefox and Thunderbird installations to these minimum versions. As a temporary workaround, developers can avoid inspecting the Request panel for POST requests from untrusted sources in the DevTools Network tab until patching is complete. Note that Firefox ESR 115.x received an attempted backport that was reverted due to test failures and was ultimately marked wontfix since ESR 115 reached end-of-life (Mozilla Bugzilla).

The vulnerability was reported externally by a researcher identified as "Cody" and triaged by Mozilla's DevTools and security teams. Internal Mozilla discussion noted that the fix pattern (using Object.create(null) instead of {}) was consistent with prior prototype pollution fixes in related DevTools components (UrlPreview.js, CookiesPanel.js), suggesting a recurring class of vulnerability in the Netmonitor codebase (Mozilla Bugzilla). The vulnerability received broad downstream coverage from Linux distribution security advisories (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, Amazon Linux) and was detected by Nessus and Qualys scanners shortly after disclosure, indicating standard patch propagation across enterprise environments.