CVE-2026-2803: 
NixOS vulnerability analysis and mitigation

CVE-2026-2803 is an information disclosure and mitigation bypass vulnerability in the Settings UI component of Mozilla Firefox and Thunderbird. Specifically, the "Require device sign-in to autofill and manage payment methods" security checkbox can be toggled to a new state even when device authentication is cancelled or dismissed, effectively disabling the OS-level authentication requirement without user authorization. The vulnerability affects Firefox and Thunderbird versions prior to 148.0 and was publicly disclosed on February 24, 2026, as part of Mozilla Foundation Security Advisory 2026-13 (Firefox) and 2026-16 (Thunderbird). It carries a CVSS v3.1 base score of 7.5 (High) per Feedly's assessment, though Mozilla rates its impact as moderate (Mozilla Advisory Firefox, Mozilla Advisory Thunderbird, Bugzilla).

The root cause is a logic flaw (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-693: Protection Mechanism Failure) in Firefox's Settings UI component handling of the payment method OS authentication checkbox. When a user clicks the checkbox to toggle the "Require device sign-in to autofill and manage payment methods" setting, Firefox triggers a Windows device authentication prompt. However, if the user clicks the checkbox a second time while the authentication prompt is still pending and then cancels or dismisses the prompt, the browser incorrectly applies the opposite checkbox state without verifying that authentication succeeded — effectively writing the new setting value without authorization. The fix, committed as Don't set OS auth for payments if user isn't authorized, ensures the setting is only persisted after successful authentication (Bugzilla, Mozilla Advisory Firefox).

Successful exploitation allows a local attacker (or a user with physical or remote access to an active Firefox session) to permanently disable the OS-level device authentication requirement for autofilling and managing saved payment methods. The changed checkbox state persists across browser restarts, meaning that after exploitation, payment card data stored in Firefox can be accessed and autofilled without any Windows authentication challenge. This represents a confidentiality impact (exposure of sensitive financial data) and a protection mechanism failure, though there is no integrity or availability impact beyond the bypass itself (Bugzilla, Mozilla Advisory Firefox).

No public exploit code, exploit kits, or in-the-wild exploitation have been reported for CVE-2026-2803. The vulnerability requires local or physical access to an active Firefox session on Windows and involves a specific multi-step interaction with the Settings UI, limiting its practical exploitability. The EPSS score is 0.017% (0.000170), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Bugzilla, Mozilla Advisory Firefox).

1. Access Firefox Settings: On a Windows system running Firefox prior to version 148, open Firefox and navigate to Settings → Privacy & Security → Payment Methods.
2. Initiate checkbox toggle: Click the "Require device sign-in to autofill and manage payment methods" checkbox once to trigger the Windows device authentication prompt.
3. Race the prompt: While the Windows authentication dialog is still open and pending, return focus to Firefox and click the same checkbox a second time.
4. Cancel authentication: Cancel or close the Windows device authentication prompt without completing authentication.
5. Observe bypass: The checkbox state changes (e.g., from enabled to disabled) and persists after reloading settings or restarting Firefox, even though authentication was never completed — disabling the OS auth requirement for payment autofill (Bugzilla).

• Logs: Firefox settings changes logged without a corresponding successful Windows authentication event in the Windows Security Event Log (Event ID 4624 or similar) around the same timestamp.
• Configuration: Firefox profile preference extensions.formautofill.reauth.enabled or equivalent payment autofill OS-auth preference set to false unexpectedly, particularly on Windows systems where the feature was previously enabled.
• User Reports: Users reporting that Firefox no longer prompts for Windows Hello/PIN/password when accessing or autofilling saved payment card information.

Mozilla has released patched versions Firefox 148 and Thunderbird 148, which fix this vulnerability by ensuring the OS authentication setting is only updated after successful device authentication. Users should update to Firefox 148 or later and Thunderbird 148 or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Organizations managing Firefox deployments via policy should verify that the payment method OS authentication setting is re-enabled after upgrading if it was inadvertently disabled (Mozilla Advisory Firefox, Mozilla Advisory Thunderbird).

Mozilla classified the vulnerability as "moderate" impact in its official security advisories for Firefox 148 and Thunderbird 148, published February 24, 2026. The bug was reported by an external researcher using the handle "Skywarp" and was eligible for Mozilla's security bug bounty program. No significant broader media coverage or notable researcher commentary beyond the standard advisory cycle has been identified for this specific CVE (Mozilla Advisory Firefox, Bugzilla).