CVE-2026-2804: 
NixOS vulnerability analysis and mitigation

CVE-2026-2804 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird. It affects Firefox and Thunderbird versions prior to 148.0 and was disclosed on February 24, 2026, as part of Mozilla Foundation Security Advisory 2026-13 (Firefox) and 2026-16 (Thunderbird). The vulnerability was reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic. Mozilla rates its impact as moderate, and it carries a CVSS v3.1 base score of 5.4 (Medium) (Mozilla Advisory, Mozilla Advisory).

The vulnerability is classified as CWE-416 (Use After Free), occurring within Firefox's and Thunderbird's JavaScript WebAssembly engine component (tracked internally as Bug 2013584). A use-after-free condition arises when a memory object in the WebAssembly subsystem is accessed after it has been freed, potentially allowing an attacker to influence the freed memory's contents and redirect program execution. Exploitation requires user interaction — typically luring a victim to visit a malicious web page — and no authentication is needed. The bug was discovered through AI-assisted security research using Anthropic's Claude model (Mozilla Advisory).

Successful exploitation could allow a remote, unauthenticated attacker to achieve limited confidentiality and integrity impacts within the context of the browser process, consistent with the CVSS scoring of low confidentiality and low integrity impact with no availability impact. In practice, this could manifest as reading sensitive data from browser memory or corrupting browser state, though the moderate severity rating suggests exploitation complexity or limited scope compared to higher-severity use-after-free bugs in the same release. For Thunderbird, Mozilla notes that these flaws generally cannot be exploited via email because scripting is disabled when reading mail, but they remain risks in browser-like contexts (Mozilla Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-2804. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is network-based and requires user interaction (e.g., visiting a malicious page), which reduces practical exploitability (Mozilla Advisory).

Mozilla has addressed this vulnerability in Firefox 148 and Thunderbird 148, released on February 24, 2026. Users and administrators should update to these versions or later immediately. No configuration-based workarounds are documented; upgrading is the only recommended remediation. Organizations using Firefox ESR or Thunderbird ESR should verify whether their ESR branch is affected and apply the corresponding ESR update if available (Mozilla Advisory, Mozilla Advisory).

This CVE is notable for being discovered through AI-assisted security research — the reporters used Anthropic's Claude model to identify the vulnerability, part of a broader batch of bugs found by the same team in the Firefox 148 release cycle. VulnCheck published a blog post discussing CVEs credited to Anthropic, highlighting the growing role of AI in vulnerability discovery (VulnCheck Blog). No significant independent researcher commentary or widespread media coverage specific to this individual CVE has been identified.