CVE-2026-2801: 
NixOS vulnerability analysis and mitigation

CVE-2026-2801 is an incorrect boundary conditions vulnerability in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird, specifically within the IntrI8PrepareB() function used by the WebAssembly.mozIntGemm() API. The flaw was discovered and reported by Kanaru Sato and disclosed on February 24, 2026, as part of Mozilla Foundation Security Advisory 2026-13 (Firefox) and 2026-16 (Thunderbird). It affects Firefox and Thunderbird versions prior to 148.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per Feedly threat intelligence data, though Mozilla rates its impact as moderate (Mozilla Advisory Firefox, Mozilla Advisory Thunderbird).

The root cause is an improper check for unusual or exceptional conditions (CWE-754) in the js::intgemm::IntrI8PrepareB() function within IntegerGemmIntrinsic.cpp. The boundary check computes the required memory size as rowsB * colsB bytes, but the actual matrix data is accessed as float values (4 bytes each), meaning the true required size is rowsB * colsB * 4. This off-by-factor-of-four error allows out-of-bounds (OOB) memory reads beyond the allocated WebAssembly buffer. Exploitation requires the attacker to operate within an add-on (extension) context, as the WebAssembly.mozIntGemm() API is gated behind isSystemOrAddOnPrincipal and is not accessible from arbitrary web content. A proof-of-concept (poc.js) was attached to the public Bugzilla report and confirmed to trigger an AddressSanitizer BUS signal on an arm64 build (Mozilla Bugzilla).

Successful exploitation can result in out-of-bounds memory access, potentially leading to memory corruption or application crash (denial of service). Because the base address of the matrix operation must still reside within valid WebAssembly memory and guard pages exist between memory regions, reliable exploitation for arbitrary code execution is considered difficult — accesses beyond the buffer boundary are likely to trigger segfaults rather than controlled memory reads or writes. The vulnerability's impact is therefore primarily an availability risk (crash), with limited confidentiality or integrity impact under typical conditions. The scope is restricted to users who have installed browser extensions on Firefox or Thunderbird, as the vulnerable API is not exposed to ordinary web content (Mozilla Bugzilla, Mozilla Advisory Firefox).

No public exploit kit integration or in-the-wild exploitation has been reported for CVE-2026-2801. A proof-of-concept script (poc.js) was submitted by the reporter and is referenced in the public Bugzilla ticket, demonstrating the OOB access via ASan-instrumented SpiderMonkey. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for a malicious browser add-on to be installed by the victim, significantly limiting the attack surface (Mozilla Bugzilla).

1. Develop or compromise a browser extension: Since WebAssembly.mozIntGemm() is only accessible in add-on (system or extension) principal contexts, an attacker must create or trojanize a Firefox/Thunderbird extension that the victim installs.
2. Invoke the vulnerable API: Within the extension's content script or background script, call WebAssembly.mozIntGemm() to access the IntrI8PrepareB intrinsic function.
3. Craft malicious matrix parameters: Supply matrix dimensions (rowsB, colsB) and buffer offsets such that the computed size (rowsB * colsB) passes the boundary check, but the actual float-sized access (rowsB * colsB * 4) extends beyond the allocated WebAssembly memory buffer.
4. Trigger OOB access: The incorrect boundary check allows the engine to read memory beyond the WebAssembly buffer boundary, potentially causing a crash (denial of service) or, in theory, exposing adjacent memory contents — though guard pages make reliable exploitation for code execution unlikely (Mozilla Bugzilla).

Mozilla has released fixed versions Firefox 148 and Thunderbird 148, which correct the boundary check in IntrI8PrepareB() to account for the float element size (multiplying by 4). Users should update to Firefox 148 or Thunderbird 148 immediately. No configuration-based workaround is available; upgrading is the only remediation. Firefox ESR 115 and ESR 140 branches are confirmed unaffected. Organizations managing browser deployments should prioritize this update, particularly for environments where users may install third-party extensions (Mozilla Advisory Firefox, Mozilla Advisory Thunderbird).

Mozilla classified the vulnerability as moderate impact in its official advisories for Firefox 148 and Thunderbird 148, noting the restricted attack surface due to the add-on-only API access. The Bugzilla discussion between the reporter (Kanaru Sato) and Mozilla engineer Ryan Hunt highlighted uncertainty about exploitability, with Hunt noting that guard pages between memory regions would likely cause segfaults rather than controlled exploitation. The bug was awarded a client security bounty by Mozilla. No significant broader media coverage or notable external researcher commentary beyond the Bugzilla thread has been identified (Mozilla Bugzilla, Mozilla Advisory Firefox).