CVE-2026-2783: 
NixOS vulnerability analysis and mitigation

CVE-2026-2783 is an information disclosure vulnerability caused by JIT miscompilation in Mozilla's JavaScript Engine JIT component. Discovered by external researcher "x0e" and disclosed on February 24, 2026, it affects Firefox versions before 148, Firefox ESR versions before 140.8, Thunderbird versions before 148, and Thunderbird ESR versions before 140.8. The vulnerability was rated "moderate" impact by Mozilla and carries a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15, Feedly).

The root cause is a type confusion (CWE-843) and information exposure (CWE-200) flaw in the SpiderMonkey JIT compiler (Ion/Warp backend). Specifically, the JIT miscompiles certain BigInt operations involving BigInt.asUintN(64, ...) combined with loop constructs, causing an Int64 value to be incorrectly allocated to a 32-bit (Int32) stack slot. When the JIT attempts to encode a snapshot for bailout recovery, it reads the 64-bit value from the narrower 32-bit slot, exposing the bottom 32 bits of an adjacent memory pointer to JavaScript-accessible values. The fix, implemented by Mozilla engineer Iain Ireland, adds support for correctly reading Int64 values from Int32 stack slots during snapshot encoding in jit/shared/CodeGenerator-shared.cpp (Mozilla Bugzilla). No user interaction or special privileges are required for exploitation, as the vulnerable code path is reachable via ordinary JavaScript execution.

Successful exploitation allows an unauthenticated remote attacker to leak the bottom 32 bits of internal memory pointers from the Firefox or Thunderbird process. This constitutes a confidentiality breach that could be used to partially defeat Address Space Layout Randomization (ASLR), potentially facilitating further exploitation of memory corruption vulnerabilities in the same browser session. Integrity and availability are not directly impacted by this vulnerability alone, but the pointer leak could serve as a stepping stone in a chained exploit (Mozilla Bugzilla, Mozilla Advisory mfsa2026-13).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-2783. The EPSS score is very low at approximately 0.018%, reflecting limited current exploitation likelihood (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Mozilla awarded a security bug bounty to the reporter, indicating the issue was responsibly disclosed. The vulnerability requires the target to visit a malicious web page or open a crafted email in Thunderbird, but no user interaction beyond that is needed once the page is loaded.

1. Craft malicious JavaScript: Prepare a JavaScript payload that triggers the vulnerable JIT code path using BigInt.asUintN(64, BigInt(n)) inside a hot loop combined with a try/catch block and a SharedArrayBuffer allocation, causing the JIT to spill a BigInt-related value to a 32-bit stack slot.
2. Host or deliver the payload: Serve the malicious JavaScript from an attacker-controlled web page, or embed it in an HTML email viewed in Thunderbird.
3. Trigger JIT compilation: The loop must execute enough iterations (e.g., ~1000) to trigger Ion/Warp JIT compilation of the target function, causing the miscompilation to occur.
4. Read leaked pointer bits: After JIT compilation, the function returns a BigInt value that contains the bottom 32 bits of an internal memory pointer, which can be read directly from JavaScript.
5. Use leaked data for further exploitation: Combine the partial pointer leak with other vulnerabilities to defeat ASLR and achieve more impactful exploitation such as code execution (Mozilla Bugzilla).

Mozilla has released patched versions that fully remediate this vulnerability: Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users and administrators should update to these versions or later immediately. No configuration-based workaround is available; upgrading is the only effective mitigation. Enterprise deployments using Firefox ESR 115.x are not affected by this specific CVE (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15). Linux distribution vendors including Red Hat, Debian, SUSE, Rocky Linux, AlmaLinux, Oracle Linux, Slackware, and Amazon Linux have also released updated packages.

Mozilla rated this vulnerability as "moderate" impact and awarded a security bug bounty to the external reporter "x0e", who also reported a related use-after-free vulnerability (CVE-2026-2795) in the same release cycle (Mozilla Bugzilla). The fix was noted internally as following the same approach used for a prior similar JIT miscompilation bug (Bug 1947141). Broad downstream coverage was observed across Linux security advisories from Red Hat, Debian, SUSE, Rocky Linux, AlmaLinux, Oracle Linux, and Slackware, reflecting standard patch propagation for a Mozilla security release. No significant independent researcher commentary or social media discussion specific to this CVE was identified.