CVE-2026-4712: 
NixOS vulnerability analysis and mitigation

CVE-2026-4712 is an information disclosure vulnerability in the Widget: Cocoa component of Mozilla Firefox and Thunderbird, affecting macOS systems that use the Cocoa UI framework. It was reported by Josh Aas and disclosed on March 24, 2026, as part of Mozilla's coordinated security advisory release. Affected versions include Firefox prior to 149, Firefox ESR prior to 140.9, Thunderbird prior to 149, and Thunderbird ESR prior to 140.9. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per Feedly threat intelligence data, though Mozilla's own advisory rates its impact as "moderate" (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), residing in Firefox's Widget: Cocoa component — the macOS-specific UI layer responsible for rendering native interface elements (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9). The flaw allows a network-accessible attacker with no required privileges or user interaction to trigger unintended information disclosure through the affected component. The underlying bug is tracked as Mozilla Bug 2017666, though the bug report is access-restricted. No public proof-of-concept code or detailed technical write-up has been identified at this time.

Successful exploitation results in a high confidentiality impact — sensitive information can be exposed to unauthorized remote actors — with no integrity or availability impact. The vulnerability is scoped to macOS environments running affected Firefox or Thunderbird versions, as the Cocoa widget layer is macOS-specific. The nature of the disclosed information is not publicly detailed due to the restricted bug report, but the CVSS network attack vector and no-interaction requirement suggest it could be triggered by a malicious web page or email content, potentially exposing user data or browser state to a remote attacker (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-4712. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. The zero-interaction network attack vector theoretically lowers the exploitation barrier, but the macOS-only scope and moderate severity classification limit its overall risk profile.

Mozilla has released patches addressing this vulnerability in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9, all announced on March 24, 2026 (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9). Users and administrators should update to the patched versions immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation. Linux distribution vendors including Red Hat, AlmaLinux, Rocky Linux, openSUSE, and Amazon Linux have also issued updated packages incorporating these fixes.

The vulnerability was part of a large batch of 37+ security fixes released with Firefox 149, which received coverage from security news outlets such as CyberSecurityNews and HealSecurity, noting the breadth of the release (CyberSecurityNews, HealSecurity). CVE-2026-4712 itself did not attract notable individual commentary, consistent with its moderate severity rating. Downstream Linux distributions and security scanner vendors (Tenable Nessus, Qualys) rapidly incorporated detection for the vulnerability following the advisory.