CVE-2026-4722: 
NixOS vulnerability analysis and mitigation

CVE-2026-4722 is a privilege escalation vulnerability in the Inter-Process Communication (IPC) component of Mozilla Firefox and Thunderbird. Discovered and reported by Nika Layzell, it was publicly disclosed on March 24, 2026, affecting Firefox versions prior to 149 and Thunderbird versions prior to 149. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), though Mozilla's own advisory rates its impact as "moderate" (Mozilla Advisory, Feedly).

The vulnerability is classified as CWE-270 (Privilege Context Switching Error), indicating a flaw in how Firefox's IPC component handles privilege transitions between processes. Firefox uses a multi-process architecture where content processes communicate with the privileged parent process via IPC; an error in this context switching can allow a less-privileged process to gain elevated privileges. The attack vector is network-based and requires user interaction (e.g., visiting a malicious web page), but no prior authentication or privileges are needed. The underlying bug is tracked as Mozilla Bug 2010097 (Mozilla Advisory, Red Hat Bugzilla).

Successful exploitation could allow an attacker to escalate privileges within the Firefox or Thunderbird process model, potentially breaking out of the browser's sandboxing constraints. This could result in unauthorized access to sensitive information (confidentiality impact), unauthorized modification or destruction of data (integrity impact), and disruption of service availability — all rated HIGH in the CVSS assessment. In Thunderbird, the risk is reduced in email contexts since scripting is disabled when reading mail, but browser-like contexts remain at risk (Mozilla Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.016% (0.000160), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 386906) and Nessus (ID: 303888) (Feedly).

Mozilla has released patches addressing this vulnerability in Firefox 149 and Thunderbird 149, both announced on March 24, 2026. Organizations should update all instances of Firefox and Thunderbird to version 149 or later as the primary remediation. No configuration-based workarounds have been published; upgrading is the only recommended mitigation. Enterprise administrators should enforce mandatory updates across all endpoints running affected versions (Firefox < 149, Thunderbird < 149) (Mozilla Advisory, Mozilla Advisory).

The vulnerability was covered by security news outlets including The Hacker Wire and CyberSecurityNews in the context of the broader Firefox 149 release, which addressed 37 vulnerabilities (Feedly). Red Hat and openSUSE both issued downstream advisories and tracking entries for their Firefox and Thunderbird packages. FreeBSD's VuXML database also catalogued the vulnerability. Community reaction has been measured given the moderate severity rating and lack of active exploitation.