CVE-2026-2794: 
NixOS vulnerability analysis and mitigation

CVE-2026-2794 is an information disclosure vulnerability caused by the use of uninitialized memory in Mozilla Firefox and Firefox Focus for Android. Specifically, the flaw resides in the ContentParent::RecvGetIconForExtension function within the GeckoView component. It affects all versions of Firefox prior to 148.0 and was disclosed on February 24, 2026, as part of Mozilla Foundation Security Advisory 2026-13. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). In RecvGetIconForExtension, a buffer (bits) is allocated using bits->AppendElements(size), which for uint8_t does not zero-initialize the allocated heap memory. The buffer is then passed to AndroidBridge::Bridge()->GetIconForExtension, which performs a memcpy only if len == bufSize; if this condition is not met, the memcpy is skipped and the function returns IPC_OK() without modifying the buffer. As a result, raw uninitialized heap memory from the parent process is transmitted back to the untrusted child process via IPC. The fix involves replacing AppendElements with a zero-initializing call (e.g., InsertElementsAt(0, aIconSize * aIconSize * 4, 0)) to ensure the buffer is zeroed before use. This vulnerability is Android-specific, as the affected code path is wrapped in #ifdef MOZ_WIDGET_ANDROID (Mozilla Bugzilla).

Successful exploitation allows a compromised child process to read uninitialized heap memory from the Firefox parent process, resulting in a high-severity information disclosure. The leaked memory could contain sensitive data such as credentials, cryptographic material, or other process-resident secrets. While there is no integrity or availability impact, the confidentiality impact is rated High, and the vulnerability could serve as a stepping stone in a broader sandbox escape chain when combined with other exploits (Mozilla Advisory, Mozilla Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-2794. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a pre-existing compromised child process, which significantly raises the bar for attackers (Mozilla Bugzilla).

1. Precondition — Compromise child process: The attacker must first achieve code execution within a Firefox for Android child (renderer) process, typically through a separate browser vulnerability such as a JavaScript engine exploit.
2. Trigger the IPC call: From the compromised child process, send an IPC message invoking RecvGetIconForExtension in the parent process with parameters crafted so that len != bufSize, causing the memcpy inside GetIconForExtension to be skipped.
3. Receive uninitialized memory: The parent process allocates a heap buffer via AppendElements (without zero-initialization) and returns it to the child process via IPC without populating it with valid icon data.
4. Extract sensitive data: The child process reads the returned buffer, which contains raw uninitialized heap memory from the parent process, potentially including sensitive data such as credentials, keys, or other process memory artifacts (Mozilla Bugzilla).

Mozilla has patched this vulnerability in Firefox 148 and Firefox 149. Users should update Firefox for Android and Firefox Focus for Android to version 148.0 or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize deploying the update to Android devices running affected Firefox versions (Mozilla Advisory).

The vulnerability was reported by external security researcher Steven Julian, who received a Mozilla security bug bounty for the discovery. Mozilla's security team classified it as sec-high and expedited a fix into the Firefox 148 beta release cycle. Internal discussion noted that the patch comment could reveal the vulnerability's nature, but the risk was considered low given the short window before the 148 release and the requirement for a pre-compromised child process (Mozilla Bugzilla).