CVE-2026-4718: 
NixOS vulnerability analysis and mitigation

CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. Disclosed on March 24, 2026, it affects Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird ESR versions prior to 140.9. Mozilla rates the impact as low in its advisories, while Feedly's CVSS v3.1 estimate assigns a base score of 8.1 (High) (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22). The vulnerability was discovered by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic (Mozilla Advisory mfsa2026-20).

The vulnerability is classified under CWE-475 (Undefined Behavior for Input to API) and CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior), indicating that the WebRTC signaling component invokes or relies on behavior that is not defined by the relevant language or API specification (Feedly). The attack vector is network-based and requires user interaction (e.g., visiting a malicious page or opening a crafted message), but no privileges are required from the attacker. The specific triggering mechanism within the WebRTC signaling path is not publicly detailed beyond the Mozilla bug tracker entry (Bug 2014864), which is not publicly accessible (Mozilla Advisory mfsa2026-22). No public proof-of-concept code has been identified at this time.

Successful exploitation of this vulnerability could allow a network-based attacker to compromise both the confidentiality and integrity of data processed by the affected WebRTC signaling component, potentially enabling unauthorized access to sensitive information or data modification (Feedly). Availability is not impacted according to the CVSS assessment. The scope is unchanged, meaning exploitation is contained to the affected browser or email client process and does not inherently enable lateral movement to other systems, though it could serve as a stepping stone in a broader attack chain (Mozilla Advisory mfsa2026-20).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is extremely low at 0.000060, reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported in connection with this CVE.

Mozilla has released patches addressing this vulnerability. Users should update to the following minimum secure versions: Firefox 149, Firefox ESR 140.9, Thunderbird 149, or Thunderbird ESR 140.9 (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22). No configuration-based workarounds have been published by Mozilla. Enterprise administrators should prioritize deploying the updated packages through their standard patch management processes; Linux distribution packages (Red Hat, Debian, openSUSE, AlmaLinux, Rocky Linux, Amazon Linux) have also been updated (Red Hat Errata).

The vulnerability was notably discovered using AI-assisted security research — specifically, the researchers used Anthropic's Claude model as part of their workflow, which was highlighted in a VulnCheck blog post covering Anthropic-credited CVEs (VulnCheck Blog). Coverage was primarily limited to routine security news outlets reporting on the Firefox 149 release, with no significant independent researcher commentary or social media discussion specific to this CVE given its low Mozilla-rated severity (CyberSecurityNews).