CVE-2026-2787: 
NixOS vulnerability analysis and mitigation

CVE-2026-2787 is a use-after-free vulnerability in the DOM: Window and Location component of Mozilla Firefox, Firefox ESR, and Thunderbird. It was discovered by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic, and was publicly disclosed on February 24, 2026. Affected versions include Firefox prior to 148, Firefox ESR prior to 115.33, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird ESR prior to 140.8. The Feedly threat intelligence data assigns a CVSS v3.1 base score of 9.8 (Critical), though Mozilla's own advisories rate the impact as "moderate" (Mozilla MFSA2026-13, Mozilla MFSA2026-14, Mozilla MFSA2026-15).

The vulnerability is classified as CWE-416 (Use After Free), occurring in the DOM: Window and Location component of the browser engine. A use-after-free flaw arises when the browser accesses memory that has already been freed, potentially allowing an attacker to control the freed memory region and redirect execution flow. The bug is tracked internally as Mozilla Bug 2014560, though the bug report is access-restricted (Mozilla MFSA2026-13). The vulnerability was identified through AI-assisted security research using Anthropic's Claude model, as part of a broader research effort that uncovered numerous memory safety issues in the same release cycle (Mozilla MFSA2026-15).

Successful exploitation of this use-after-free vulnerability could allow a remote attacker to achieve arbitrary code execution within the context of the browser process, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could leverage this to read sensitive data from browser memory, modify application state, or cause a denial of service via application crash. Because the vulnerability resides in the browser's DOM Window and Location handling, it could be triggered by a malicious web page or HTML email in Thunderbird, affecting any user running a vulnerable version (Mozilla MFSA2026-13, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024%, indicating a low current probability of exploitation in the wild. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported in connection with this CVE.

Mozilla has released patches addressing CVE-2026-2787 in the following versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users and administrators should update all affected Mozilla products to the patched versions immediately, prioritizing internet-facing or externally accessible systems. No configuration-based workarounds have been published; upgrading to a fixed version is the only recommended remediation (Mozilla MFSA2026-13, Mozilla MFSA2026-14, Mozilla MFSA2026-15).

The vulnerability was part of a large batch of security fixes released by Mozilla on February 24, 2026, many of which were discovered using AI-assisted research (Anthropic's Claude). This AI-assisted discovery approach attracted notable attention in the security community, with VulnCheck publishing a blog post specifically discussing the Anthropic/Glasswing-credited CVEs from this release cycle (VulnCheck Blog). Downstream Linux distributions including Red Hat, Debian, SUSE, Rocky Linux, AlmaLinux, Oracle Linux, Slackware, and Amazon Linux all issued advisories and updated packages in the days following the Mozilla disclosure.