CVE-2026-2791: 
NixOS vulnerability analysis and mitigation

CVE-2026-2791 is a mitigation bypass vulnerability in the Networking: Cache component of Mozilla Firefox and Thunderbird, disclosed on February 24, 2026. It affects Firefox versions prior to 148, Firefox ESR versions prior to 140.8, Thunderbird versions prior to 148, and Thunderbird ESR versions prior to 140.8. Mozilla officially rates this vulnerability as low impact in its security advisories, though automated scoring systems have estimated a higher severity (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15). The vulnerability was reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic (Mozilla Advisory mfsa2026-15).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), representing a flaw where an attacker can circumvent security mitigations implemented in Firefox and Thunderbird's network cache component via an alternate path or channel. The specific technical mechanism by which the mitigation bypass occurs in the cache layer is not publicly detailed, as the underlying bug report (Mozilla Bug 2015220) is access-restricted. The attack vector is network-based, and the vulnerability was discovered through AI-assisted security research using Anthropic's Claude model (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15).

According to Mozilla's official advisories, the impact of this vulnerability is rated low, suggesting the practical consequences are limited compared to other vulnerabilities fixed in the same release cycle. The bypass of networking cache mitigations could potentially allow an attacker to circumvent security controls intended to protect cached network resources, but the full scope of exploitable impact is constrained by the low severity rating. No evidence of data exfiltration, privilege escalation, or remote code execution has been attributed to this specific vulnerability (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15).

There is no public proof-of-concept exploit available for CVE-2026-2791, and no evidence of in-the-wild exploitation has been reported (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified in connection with this vulnerability.

Mozilla has released patches addressing CVE-2026-2791 in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8, all announced on February 24, 2026. Users and administrators should upgrade to one of these patched versions immediately. Downstream Linux distributions including Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux 2, and Slackware have also released updated packages incorporating these fixes (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15). No configuration-based workaround is available; patching is the only recommended remediation.

This vulnerability was part of a broader February 24, 2026 Mozilla security release that addressed numerous high-severity issues in Firefox 148 and Firefox ESR 140.8, drawing attention primarily due to the volume and severity of co-disclosed vulnerabilities rather than CVE-2026-2791 specifically. Notably, several vulnerabilities in the same release were discovered using AI-assisted research (Anthropic's Claude), which generated broader industry commentary about AI-aided vulnerability discovery (Mozilla Advisory mfsa2026-13). A VulnCheck blog post specifically discussed CVEs credited to Anthropic's AI tooling in this release cycle (VulnCheck Blog).