CVE-2026-4704: 
NixOS vulnerability analysis and mitigation

CVE-2026-4704 is a denial-of-service vulnerability in the WebRTC: Signaling component of Mozilla Firefox and Thunderbird. It affects Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird ESR versions prior to 140.9. The vulnerability was disclosed on March 24, 2026, as part of Mozilla's security advisory releases MFSA 2026-20 and MFSA 2026-22. It carries a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability is rooted in uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770) within Firefox's WebRTC signaling subsystem. An unauthenticated remote attacker can trigger the flaw over the network without requiring user interaction or elevated privileges, by sending crafted WebRTC signaling messages that cause the browser to exhaust available resources. The bug was tracked internally as Mozilla Bug 2014868 and was discovered by a team of researchers — Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger — using Claude from Anthropic, representing a notable AI-assisted vulnerability discovery (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

Successful exploitation results in a denial-of-service condition, causing the affected Firefox or Thunderbird application to become unresponsive or crash. The impact is limited to availability — there is no confidentiality or integrity impact, and the scope is unchanged, meaning the attack cannot propagate beyond the targeted browser process. Users relying on Firefox or Thunderbird for communication or productivity would experience service disruption, but no data exfiltration or code execution is expected from this vulnerability alone (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-4704 as of the available data. The vulnerability has an EPSS score of approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is network-based with no authentication or user interaction required, which lowers the barrier for exploitation in theory, but the DoS-only impact limits attacker motivation (Mozilla Advisory Firefox 149).

Mozilla has released patches addressing this vulnerability in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9, all announced on March 24, 2026. Users and administrators should update to these versions or later immediately. No configuration-based workaround is documented; upgrading is the only recommended remediation. Downstream Linux distributions including Red Hat, Debian, openSUSE, AlmaLinux, Rocky Linux, and Amazon Linux have also released updated packages (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability was notably discovered using Claude, an AI assistant from Anthropic, as part of a collaborative research effort by a team of security researchers. This drew attention in the security community as an example of AI-assisted vulnerability research contributing to responsible disclosure. VulnCheck published a blog post specifically discussing CVEs credited to Anthropic's AI tooling, highlighting this class of discoveries (VulnCheck Blog). Coverage also appeared in security news outlets such as CyberSecurityNews and HealSecurity, noting Firefox 149's broad patch scope of 37 vulnerabilities.