CVE-2026-2795: 
NixOS vulnerability analysis and mitigation

CVE-2026-2795 is a use-after-free (UAF) vulnerability in the JavaScript Garbage Collection (GC) component of Mozilla Firefox and Thunderbird. It affects all Firefox versions prior to 148.0 and all Thunderbird versions prior to 148.0, introduced by a code refactoring in version 144 (bug 1984091). The vulnerability was reported by external researcher "x0e" and disclosed on February 24, 2026, when Mozilla published security advisories MFSA2026-13 (Firefox) and MFSA2026-16 (Thunderbird). It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416) in the FinalizationRegistryObject handling within SpiderMonkey's GC subsystem (js/src/gc/Marking.cpp). Specifically, a FinalizationQueueObject can survive a GC cycle in which its owning FinalizationRegistryObject dies; because no read barrier is applied when a weak pointer to a FinalizationRecordObject is promoted to a strong reference and added to the cleanup queue, the queue can contain dangling pointers to already-freed FinalizationRecordObjects. When the GC subsequently attempts to trace these records, it accesses freed memory, triggering an assertion failure and segmentation fault. The bug was reproducible with a crafted JavaScript test case using FinalizationRegistry, newGlobal, and Int8Array under aggressive GC zeal settings. The fix clears queued records for dead finalization registries during the sweep phase (Mozilla Bugzilla, Mozilla Advisory).

Successful exploitation could allow a remote attacker to achieve arbitrary code execution in the context of the browser or email client process, potentially leading to complete system compromise. The vulnerability has high confidentiality, integrity, and availability impact — an attacker could read sensitive data, modify application state, or crash the affected application. In Thunderbird, the risk is reduced in email-reading contexts because JavaScript is disabled, but browser-like contexts (e.g., embedded web content) remain at risk (Mozilla Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Mozilla's internal assessment noted that constructing a reliable exploit would be "very difficult" given the complexity of the GC interaction involved (Mozilla Bugzilla, Mozilla Advisory).

Mozilla has released patched versions that address this vulnerability: Firefox 148 and Thunderbird 148. Users and organizations should update immediately to these versions or later. Firefox ESR 115.x and ESR 140.x branches are unaffected by this specific vulnerability. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize deployment given the critical CVSS score and the ease of triggering the condition via crafted JavaScript (Mozilla Advisory, Mozilla Advisory).

Mozilla awarded a security bug bounty to the external reporter "x0e" for responsibly disclosing this vulnerability. The Firefox 148 release received coverage noting the large number of high-severity security fixes included alongside new features such as an AI kill switch (Mozilla Bugzilla). No significant threat actor commentary or notable social media discussion specific to this CVE has been identified beyond standard vulnerability aggregator coverage.