CVE-2026-2799: 
NixOS vulnerability analysis and mitigation

CVE-2026-2799 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It affects Firefox versions prior to 148 and Thunderbird versions prior to 148, and was disclosed on February 24, 2026, via Mozilla Security Advisories MFSA2026-13 (Firefox) and MFSA2026-16 (Thunderbird). The vulnerability was reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-16).

The vulnerability is classified as CWE-416 (Use After Free), occurring in Firefox and Thunderbird's DOM: Core & HTML component (tracked as Bug 2014551). A use-after-free flaw arises when a program continues to use a pointer to memory after that memory has been freed, potentially allowing an attacker to control the freed memory region and redirect execution flow. The attack vector is network-based, requires no authentication, no privileges, and no user interaction beyond visiting a malicious page or interacting with browser-like content, making it exploitable by any remote unauthenticated attacker. The Thunderbird advisory notes that these flaws generally cannot be exploited via email since scripting is disabled when reading mail, but they are risks in browser or browser-like contexts (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-16).

Successful exploitation of CVE-2026-2799 could allow a remote unauthenticated attacker to execute arbitrary code on the affected system with the privileges of the browser or email client process. The vulnerability has high impact to confidentiality, integrity, and availability, potentially resulting in complete compromise of the affected host. In a browser context, this could enable data theft, installation of malware, or further lateral movement within a network (Mozilla Advisory MFSA2026-13, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2026-2799. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Feedly).

Mozilla has released patched versions addressing this vulnerability: Firefox 148 and Thunderbird 148. Users and administrators should update to these versions or later immediately. Where automatic updates are enabled, ensure they have been applied. As a temporary measure prior to patching, restrict access to untrusted websites and avoid opening suspicious content in browser-like contexts within Thunderbird (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-16).

The vulnerability was notably discovered using Claude, an AI assistant from Anthropic, by a team of researchers including Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger — highlighting the growing role of AI-assisted vulnerability research. VulnCheck published a blog post discussing CVE-2026-2799 in the context of Anthropic-credited CVEs, reflecting broader industry interest in AI-assisted security research (VulnCheck Blog, Mozilla Advisory MFSA2026-13).