CVE-2026-2790: 
NixOS vulnerability analysis and mitigation

CVE-2026-2790 is a same-origin policy (SOP) bypass vulnerability in the Networking: JAR component of Mozilla Firefox and Thunderbird. Discovered and reported by security researcher Surya Dev Singh, it was publicly disclosed on February 24, 2026, alongside the release of patched versions. The vulnerability affects Firefox prior to version 148, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird ESR prior to 140.8. Mozilla rated this vulnerability as low impact in its official advisories, though third-party scoring has assigned it a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The root cause is an Origin Validation Error (CWE-346) stemming from inconsistent percent-decoding and filename normalization in Firefox's jar: URL handler — a bypass of the earlier fix for CVE-2025-1936 (Bug 1940027). An attacker crafts a ZIP/JAR archive containing an entry whose filename includes a literal percent-encoded null byte sequence (%00), then accesses it via a double-encoded jar: URL (e.g., jar:file:///path/to/test.zip!/test.png%2500). Firefox displays the normalized filename (e.g., test.png) in the UI while resolving the raw decoded filename during resource fetching, causing the browser to misinterpret the file's MIME type and execute attacker-controlled HTML/JavaScript content. The fix disables content sniffing for JAR channels when the content type is UNKNOWN_CONTENT_TYPE, requiring resources loaded from JAR files to have correct file extensions (Mozilla Bugzilla).

Successful exploitation allows an attacker to bypass the same-origin policy, enabling execution of arbitrary JavaScript in the context of a jar: URL resource. The most realistic abuse scenario involves a malicious browser extension packaging a crafted JAR/ZIP resource with a misleading filename that appears benign during review but executes script at runtime, potentially enabling cross-origin data access, content manipulation, or further privilege escalation within the browser context. While Mozilla assessed the direct impact as low severity, the vulnerability could be chained with other issues to achieve broader compromise (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability has an EPSS score of approximately 0.018% (0.000180), indicating a low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the victim to navigate to a specially crafted jar: URL, which limits the attack surface primarily to scenarios involving malicious extensions or social engineering.

1. Craft a malicious archive: Create a ZIP/JAR file containing an entry whose filename includes a literal percent-encoded null byte (%00), with the file contents being attacker-controlled HTML/JavaScript. Example using Python:

import zipfile
with zipfile.ZipFile("test.zip", "w") as z:
    z.writestr("test.png%00", "<script>alert(1)</script>")

2. Host or deliver the archive: Place the crafted ZIP file in a location accessible to the target (e.g., local filesystem, network share, or via a malicious browser extension that bundles the archive as a resource).
3. Construct the double-encoded URL: Build a jar: URL using double-encoding of the null byte (%2500) to reference the malicious entry, e.g., jar:file:///C:/path/to/test.zip!/test.png%2500.
4. Induce navigation: Trick the victim into navigating to the crafted jar: URL (e.g., via a malicious extension, a redirect, or social engineering).
5. Achieve script execution: Firefox resolves the double-encoded URL to the malicious entry, misidentifies the MIME type due to inconsistent decoding, and executes the embedded JavaScript in the jar: URL context, bypassing the same-origin policy (Mozilla Bugzilla).

• Network: Unusual requests or redirects to jar: protocol URLs, particularly those containing double-encoded sequences such as %2500 in the path component.
• File System: Presence of unexpected ZIP or JAR files in user-accessible directories (e.g., Downloads, Temp) containing entries with percent-encoded null bytes (%00) in filenames.
• Logs: Browser history or proxy logs showing navigation to jar:file:// URLs with %2500 or similar double-encoded null byte patterns in the entry path.
• Process: Unexpected JavaScript execution or alert dialogs originating from jar: URL contexts in Firefox or Thunderbird processes.

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should update all affected Firefox and Thunderbird installations immediately. No configuration-based workaround is available; upgrading to a patched version is the only remediation. Administrators should conduct an inventory of Firefox and Thunderbird deployments to identify versions below 148 (or 140.8 for ESR) and prioritize patching (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

Mozilla officially rated this vulnerability as low impact in its security advisories (MFSA2026-13 and MFSA2026-15), in contrast to third-party CVSS scoring that assigned it a 9.8 Critical score — a discrepancy that reflects Mozilla's assessment of the limited realistic attack surface (requiring user interaction with a crafted jar: URL). The bug was reported by external researcher Surya Dev Singh through Mozilla's bug bounty program and was awarded a security bounty. Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux, and Slackware all issued downstream advisories and updated packages following the Mozilla release (Mozilla Bugzilla).