CVE-2026-4691: 
NixOS vulnerability analysis and mitigation

CVE-2026-4691 is a use-after-free vulnerability in the CSS Parsing and Computation component of Mozilla Firefox and Thunderbird. Discovered by researcher Fabius Artrel and disclosed on March 24, 2026, it affects Firefox versions prior to 149, Firefox ESR versions prior to 115.34 and 140.9, and the corresponding Thunderbird releases. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network-exploitable, no-interaction-required nature (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22, Feedly).

The vulnerability is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), arising from improper memory management in Firefox's CSS parsing and computation subsystem. When the browser processes certain CSS constructs, an object can be freed while a reference to it remains in use, allowing an attacker to trigger a dangling pointer dereference. Exploitation requires no user interaction and no special privileges — a victim simply needs to visit a malicious web page or open a crafted HTML email in Thunderbird. The underlying bug is tracked as Mozilla Bug 2017512, though the bug report is access-restricted (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-21).

Successful exploitation of CVE-2026-4691 could allow a remote, unauthenticated attacker to achieve arbitrary code execution within the context of the browser or email client process, with high impact to confidentiality, integrity, and availability. An attacker could leverage this to steal sensitive data accessible to the browser, install malware, or pivot to further compromise the underlying system. The broad deployment of Firefox and Thunderbird across enterprise and consumer environments significantly amplifies the potential attack surface (Feedly, Mozilla Advisory mfsa2026-20).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.026%, indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported.

Mozilla has released patches addressing CVE-2026-4691 in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Organizations should immediately update all affected installations to these versions or later. For environments unable to patch immediately, restricting user access to untrusted web content and disabling HTML email rendering in Thunderbird can reduce exposure until patches are deployed. Downstream Linux distributions including Red Hat, AlmaLinux, Rocky Linux, Debian, openSUSE, and Amazon Linux have also issued updated packages (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-21, Mozilla Advisory mfsa2026-22).

The vulnerability was part of a large batch of security fixes released by Mozilla on March 24, 2026, covering Firefox 149 and associated ESR releases, which collectively addressed 37 vulnerabilities. Security news outlets such as CyberSecurityNews and HealSecurity covered the Firefox 149 release, highlighting the breadth of fixes. Community discussion on platforms like Mastodon (infosec.exchange) noted the release, and multiple Linux distribution security teams promptly issued advisories and updated packages, reflecting the broad ecosystem impact of Mozilla browser vulnerabilities.