CVE-2026-2798: 
NixOS vulnerability analysis and mitigation

CVE-2026-2798 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird, specifically within the Document::HidePopover function triggered via beforetoggle event reentrancy. It affects Firefox versions below 148.0 and Thunderbird versions below 148.0 (ESR 115 and ESR 140 branches are unaffected). The vulnerability was reported by security researcher Sajeeb Lohani, disclosed and patched on February 24, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (Mozilla Advisory, Mozilla Advisory Thunderbird).

The root cause (CWE-416: Use After Free) lies in Document::HidePopover (Document.cpp), which captures a raw PopoverData* pointer before dispatching a synchronous beforetoggle event. A malicious beforetoggle handler can free the original PopoverData by removing the popover attribute and immediately reallocate a new one by re-adding the attribute and calling showPopover(). After the handler returns, the stale pointer is used at lines 16295 and 16304 to call data->SetInvoker(nullptr), which reads 8 bytes from freed memory and invokes Release() on whatever value it finds — a virtual function call through a potentially attacker-controlled vtable pointer. Because the attacker has a full JavaScript execution window between the free and the use, heap spray techniques can place controlled data at the freed address (a predictable 48-byte jemalloc size class), enabling a controlled virtual function call primitive. The regression was introduced by Bug 1968987 and does not affect Firefox ESR 115 or ESR 140 (Mozilla Bugzilla).

Successful exploitation allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the browser process by luring a user to a malicious web page. The vulnerability provides high confidentiality, integrity, and availability impact, potentially enabling full compromise of the affected system. For Thunderbird, the risk is limited to browser-like contexts, as JavaScript is disabled when reading email (Mozilla Advisory, Mozilla Advisory Thunderbird).

No public proof-of-concept exploit or in-the-wild exploitation has been observed as of the time of disclosure. However, the Bugzilla report includes a detailed heap spray PoC (attached by the reporter and confirmed by Mozilla staff to reliably crash a Mac Nightly build at address 0x4141414141414141), demonstrating a clear path to exploitation. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.037% (Mozilla Bugzilla, Feedly).

1. Craft a malicious web page: Create an HTML page containing a popover element and a JavaScript beforetoggle event listener designed to trigger reentrancy during hidePopover().
2. Trigger the UAF condition: Call el.showPopover() to initialize the popover, then call el.hidePopover(). Inside the beforetoggle handler (fired when newState === 'closed'), call el.removeAttribute('popover') to free the original PopoverData, then el.setAttribute('popover', 'auto') and el.showPopover() to allocate a new PopoverData at a potentially different address.
3. Heap spray to reclaim freed memory: After freeing the original 48-byte PopoverData, spray the heap with ~2000 controlled 48-byte allocations (e.g., nsStringBuffer objects with 19 UTF-16 characters) to reclaim the freed slot. Place attacker-controlled data at byte offset 16 (the mInvokerElement field).
4. Achieve controlled virtual call: When HidePopover resumes after the handler and calls data->SetInvoker(nullptr) on the stale pointer, it reads the attacker-controlled value at offset 16 and calls Release() on it as a virtual function, redirecting execution to an attacker-chosen address.
5. Deliver payload: Host the page on an attacker-controlled server and socially engineer the target into visiting it with a vulnerable Firefox or Thunderbird version below 148 (Mozilla Bugzilla).

• Process: Unexpected child processes spawned by the Firefox or Thunderbird process (e.g., cmd.exe, /bin/sh, curl, wget, powershell) following browser activity on an untrusted site.
• Crash Artifacts: Browser crash reports with signature [@ mozilla::dom::PopoverData::SetInvoker] or EXC_BAD_ACCESS at address 0x4141414141414141 in crash dump files.
• Memory/ASan Logs: AddressSanitizer output indicating heap-use-after-free in mozilla::dom::Document::HidePopover at Document.cpp:16295 or 16304.
• Network: Outbound connections from the browser process to unexpected external IPs or domains immediately after visiting an untrusted page, potentially indicating post-exploitation C2 activity.
• File System: Unexpected files written to the user profile directory or temp directories by the browser process (Mozilla Bugzilla).

Mozilla has released fixed versions: Firefox 148 and Thunderbird 148, both announced on February 24, 2026. Firefox ESR 115 and ESR 140 are unaffected by this specific vulnerability. The fix moves the GetPopoverData() call to after the beforetoggle event dispatch, eliminating the stale pointer. Users should update to Firefox 148+ or Thunderbird 148+ immediately; enabling automatic updates is strongly recommended as no configuration-based workaround exists (Mozilla Advisory, Mozilla Advisory Thunderbird).

Mozilla awarded a bug bounty for this report, splitting it with a duplicate submission found within the collision window, indicating the vulnerability was independently discovered. The Bugzilla report notes AI involvement in the discovery process (keyword ai-involved). Coverage appeared on The Hacker Wire and several vulnerability aggregation platforms shortly after disclosure. No significant broader industry or social media reaction has been documented beyond standard vulnerability tracking (Mozilla Bugzilla, The Hacker Wire).