CVE-2026-3845: 
NixOS vulnerability analysis and mitigation

CVE-2026-3845 is a heap buffer overflow vulnerability in the Audio/Video: Playback component of Firefox for Android, specifically triggered during AV1 10-bit 4:4:4 (I444) video decoding. The root cause is a size_t-to-uint32_t narrowing truncation in BufferRecycleBin::GetBuffer, which causes an undersized allocation followed by a massive (~4 GB) out-of-bounds write. It affects Firefox for Android versions prior to 148.0.2. Disclosed on March 10, 2026, via Mozilla Security Advisory MFSA2026-19, it carries a CVSS v3.1 base score of 8.8 (High) (Mozilla Advisory, Feedly).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and stems from an implicit narrowing conversion in BufferRecycleBin::GetBuffer(uint32_t aSize) at gfx/layers/ImageContainer.cpp:88. Its caller, VideoData::QuantizableBuffer::AllocateRecyclableData(size_t aLength) in dom/media/MediaData.cpp, passes a size_t value that silently truncates to uint32_t with no overflow check. When decoding an AV1 Profile 1 (10-bit I444) frame with dimensions exceeding approximately 37,853×37,853 pixels, the total output buffer size (yLength + 2*uvLength) exceeds UINT32_MAX (~4.29 GB); GetBuffer allocates only the truncated low-32-bit value (~10.67 MB), while the subsequent libyuv I410ToI444 call writes the full ~4.01 GB into the undersized allocation. On affected Android devices (e.g., Pixel 6/7 with specific GPU configurations), the non-default media.prefer-non-ffvpx=true pref is effectively set by the FFVPX decoder path triggered by bug 1970771, making exploitation possible without user-modified settings. The attack vector is network-based and requires only user interaction (visiting a malicious page or opening a crafted media file) (Mozilla Bugzilla, Mozilla Advisory).

Successful exploitation results in a massive heap buffer overflow (~4 GB write into a ~10.67 MB allocation), causing application crash (denial of service) at minimum, and potentially enabling arbitrary code execution in the Firefox content or RDD (Remote Data Decoder) process on Android. The overflow can corrupt adjacent heap objects, overwrite executable code sections (libxul.so), and in a worst-case scenario allow an attacker to execute arbitrary code on the victim's Android device with the privileges of the Firefox process. Confidentiality, integrity, and availability are all rated High (Mozilla Bugzilla, Feedly).

A proof-of-concept exploit (poc_37755_exploit.mp4 and poc_37853_real.mp4) was submitted by the external reporter 'crixer' and is referenced in the Mozilla Bugzilla entry, though it is not publicly released. The PoC achieves 100% reproducibility on Android x86_64 emulators with 16 GB RAM and on affected physical devices (Pixel 6/7 class). No in-the-wild exploitation has been confirmed, and the EPSS score is 0.00039 (very low probability of near-term exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (loading a malicious page or media file) but no authentication (Mozilla Bugzilla, Feedly).

1. Craft malicious AV1 media file: Create an MP4 container (not WebM, which enforces a MAX_DIMENSION=16384 check) embedding an AV1 Profile 1 (High), 10-bit I444 bitstream with frame dimensions of approximately 37,853×37,853 pixels or larger. Use all-skip DC_PRED blocks to minimize file size (~25 KB) via high compressibility.
2. Host the media file: Serve the crafted MP4 from an attacker-controlled web server on a page with an HTML <video> element pointing to the file, with autoplay enabled.
3. Lure the victim: Deliver the malicious URL to a Firefox for Android user (versions < 148.0.2) via phishing, malvertising, or other social engineering. On affected Android GPU devices (e.g., Pixel 6/7), the vulnerable To8BitPerChannel codepath is triggered automatically without requiring non-default preferences.
4. Trigger the overflow: When the victim's browser loads the page, the DAV1D decoder processes the oversized AV1 frame. AllocateRecyclableData passes the ~4.3 GB size_t buffer size to GetBuffer(uint32_t), which truncates it to ~10.67 MB and allocates an undersized buffer. libyuv I410ToI444 then writes ~4.01 GB into this buffer, causing a massive heap overflow within 10–60 seconds of page load.
5. Achieve code execution or crash: The overflow corrupts adjacent heap metadata and potentially overwrites libxul.so executable sections. A crash (SIGSEGV) is the immediate result; with further exploit development, arbitrary code execution in the content or RDD process may be achievable (Mozilla Bugzilla).

• Network: HTTP requests fetching an MP4 file from an untrusted or newly registered domain, followed by a browser crash shortly after; unusual outbound connections from the Firefox process post-crash.
• Process: Firefox for Android (content process or RDD/MediaPDecoder thread) crashing with SIGSEGV (signal 11, code SEGV_ACCERR) on Android; process name org.mozilla.geckoview_example:tab* or equivalent appearing in crash logs with fault address in jemalloc-decommitted memory.
• Logs (Android Tombstone): Tombstone entries showing signal 11 (SIGSEGV), code 2 (SEGV_ACCERR) with backtrace frames referencing libxul.so offsets consistent with DAV1DDecoder::ConstructImage, VideoData::QuantizableBuffer::To8BitPerChannel, and libyuv::Planar16bitTo8bit; register values showing rbx = 0x93DD (37,853) and destination pointer in [anon:jemalloc-decommitted] space.
• Logs (ASAN/Desktop): ASAN CHECK failed: sanitizer_allocator_secondary.h:199 with poison value 0x8080808080808080 in the crash output, indicating libyuv pixel data overwriting ASAN allocator metadata.
• File System: Presence of crash dump/tombstone files (e.g., /data/tombstones/tombstone_0*) on Android devices running Firefox < 148.0.2, generated repeatedly (auto-restart causing second crash) (Mozilla Bugzilla).

Mozilla has released Firefox for Android 148.0.2, which fixes this vulnerability by validating the buffer size before allocation (adding an overflow check in BufferRecycleBin::GetBuffer). The fix was also uplifted to Firefox 149 and 150. Users should immediately update Firefox for Android to version 148.0.2 or later via the Google Play Store. As a temporary workaround prior to patching, users can avoid visiting untrusted websites or opening untrusted media files; on non-affected-GPU devices, the default media.prefer-non-ffvpx=false setting prevents the vulnerable code path from being triggered (Mozilla Advisory, Mozilla Bugzilla).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Mozilla Firefox, including CVE-2026-3845, could allow for arbitrary code execution (CIS Advisory). Neowin covered the Firefox 148.0.2 release, noting it fixed YouTube bugs, poor video quality on NVIDIA GPUs, and security issues. The Hacker Wire published a dedicated write-up on the heap overflow in Firefox for Android's A/V playback component. Community discussion on Bluesky referenced the vulnerability shortly after disclosure. Overall, industry reaction was measured given the absence of in-the-wild exploitation and the availability of a patch on the same day as disclosure.