CVE-2026-2797: 
NixOS vulnerability analysis and mitigation

CVE-2026-2797 is a use-after-free vulnerability in the JavaScript Garbage Collector (GC) component of Mozilla Firefox and Thunderbird. It affects Firefox versions prior to 148.0 and Thunderbird versions prior to 148.0. The vulnerability was disclosed on February 24, 2026, as part of Mozilla Foundation Security Advisories MFSA2026-13 (Firefox) and MFSA2026-16 (Thunderbird). It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory, Mozilla Advisory).

The vulnerability is classified as CWE-416 (Use After Free), occurring within Firefox's JavaScript engine Garbage Collector component. A use-after-free condition arises when memory that has been freed by the GC is subsequently accessed, potentially allowing an attacker to control the freed memory region and redirect execution flow. The flaw was discovered and reported by a team of researchers — Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger — using Claude from Anthropic, making it a notable example of AI-assisted vulnerability research (Mozilla Advisory). The bug is tracked internally as Bugzilla bug 2013561, though the report is access-restricted.

Successful exploitation of CVE-2026-2797 could allow a remote, unauthenticated attacker to achieve arbitrary code execution within the context of the browser or email client process. The CVSS assessment reflects high confidentiality, integrity, and availability impact, meaning an attacker could read sensitive data, modify or delete data, and disrupt application availability. For Thunderbird, Mozilla notes that these flaws generally cannot be exploited via email because scripting is disabled when reading mail, but they remain risks in browser or browser-like contexts (Mozilla Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.017%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (IDs 386690, 386691) and Tenable Nessus (IDs 300190, 300606).

Mozilla has released patches addressing this vulnerability in Firefox 148.0 and Thunderbird 148.0. Users should update immediately to these versions or later. Organizations unable to patch immediately should consider restricting access to untrusted web content and disabling JavaScript where operationally feasible as a temporary measure (Mozilla Advisory, Mozilla Advisory).

This vulnerability was notably discovered using Claude, an AI assistant from Anthropic, as part of a collaborative research effort by a team of security researchers. A VulnCheck blog post highlighted this CVE among a set of Anthropic-credited CVEs, drawing attention to the emerging role of AI in vulnerability discovery (VulnCheck Blog). The broader Firefox 148 release addressed a large number of high-severity vulnerabilities simultaneously, which attracted coverage from security news outlets and community trackers.