CVE-2026-2802: 
NixOS vulnerability analysis and mitigation

CVE-2026-2802 is a race condition vulnerability in the JavaScript Garbage Collector (GC) component of Mozilla Firefox and Thunderbird. It affects Firefox and Thunderbird versions prior to 148.0, and was introduced in version 146 via a regression from bug 1994023. The vulnerability was discovered by Gary Kwong (gkw) through fuzzing and publicly disclosed on February 24, 2026, when Mozilla released Firefox 148 and Thunderbird 148. It carries a CVSS v3.1 base score of 4.2 (Medium) (Mozilla Advisory, Mozilla Advisory).

The root cause is a race condition (CWE-362) between OOM (out-of-memory) cleanup operations and background GC sweeping in Firefox's JavaScript engine. Specifically, the setGrayBitsInvalid() function iterates over symbol arenas while background sweeping can concurrently modify the same linked list, leading to an assertion failure (element at ds/SinglyLinkedList.h:77) and potential crash. The fix involves waiting for any background sweeping to complete before marking gray bits invalid, preventing the concurrent access. Exploitation requires specific GC timing and thread scheduling conditions, making it difficult to reliably trigger (Mozilla Bugzilla).

Successful exploitation can result in a browser crash (denial of service) and potentially limited information disclosure or integrity impact due to the memory state corruption caused by the race condition. The CVSS assessment reflects low confidentiality and integrity impact with no availability impact scored, though the Bugzilla entry notes the potential for a crash as a security concern. The vulnerability affects both desktop (Firefox, Thunderbird) and Android platforms. In Thunderbird, the flaw cannot be exploited via email since scripting is disabled when reading mail, but is a risk in browser-like contexts (Mozilla Advisory, Mozilla Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-2802. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Mozilla's own security assessment notes that constructing a reliable exploit is difficult due to its dependence on GC timing and thread scheduling (Mozilla Bugzilla).

Mozilla has addressed this vulnerability in Firefox 148 and Thunderbird 148, released on February 24, 2026. The fix ensures that background GC sweeping completes before gray bits are marked invalid, eliminating the race condition. Users and administrators should update Firefox and Thunderbird to version 148.0 or later immediately. Firefox ESR 115.x and ESR 140.x branches are unaffected by this specific vulnerability (Mozilla Advisory, Mozilla Advisory).

Mozilla classified the vulnerability as "moderate" impact in its security advisory and awarded a security bug bounty to the reporter. The bug was internally tracked as a P1/S2 priority defect, reflecting its significance to GC stability. No notable independent researcher commentary or significant media coverage beyond standard vulnerability tracking has been identified for this specific CVE.