CVE-2026-4701: 
NixOS vulnerability analysis and mitigation

CVE-2026-4701 is a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox and Firefox ESR. Reported by Gary Kwong and disclosed on March 24, 2026, it affects Firefox versions before 149 and Firefox ESR versions before 140.9, as well as the corresponding Thunderbird releases (149 and 140.9). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) per Feedly threat intelligence data, though Mozilla's own advisory rates its impact as "moderate" (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), arising from improper memory management within Firefox's JavaScript Engine component. A use-after-free condition occurs when the engine accesses memory that has already been freed, potentially allowing an attacker to control the contents of that memory region and redirect execution flow. The flaw is reachable via the network with no authentication or user interaction required, making it exploitable through crafted web content delivered to a vulnerable browser. The underlying bug is tracked as Mozilla Bug 2009303, though the bug report is access-restricted (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

Successful exploitation could result in arbitrary code execution within the context of the browser process, potentially compromising confidentiality, integrity, and availability of the affected system. An attacker who controls freed memory could leverage the dangling pointer to execute attacker-controlled code, access sensitive browser data (e.g., credentials, session tokens, browsing history), or crash the browser. While Mozilla rates the severity as moderate, the CVSS 9.8 score reflects the network-accessible, no-interaction-required attack surface, and exploitation could serve as a stepping stone for further lateral movement if combined with a sandbox escape (Mozilla Advisory Firefox 149, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a low current probability of exploitation in the wild. No threat actor attribution has been reported.

Mozilla has released patches addressing this vulnerability in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Users and administrators should update to these versions or later immediately. As a temporary workaround where updates cannot be applied promptly, consider restricting access to untrusted websites and disabling JavaScript execution in browser settings, though this may significantly impact usability. Enterprise deployments should prioritize patch rollout given the critical CVSS score and network-accessible attack vector (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability was part of a large batch of security fixes released by Mozilla on March 24, 2026, covering Firefox 149 and ESR 140.9. Security news outlets such as CyberSecurityNews and HealSecurity covered the Firefox 149 release, noting it addressed 37 vulnerabilities. Multiple Linux distributions including Red Hat, Debian, openSUSE, AlmaLinux, Rocky Linux, Amazon Linux, and Slackware issued downstream security advisories and updated packages shortly after Mozilla's disclosure. Vulnerability scanning vendors Qualys and Tenable (Nessus) added detection plugins for this CVE within days of disclosure (Mozilla Advisory Firefox 149).