CVE-2026-4723: 
NixOS vulnerability analysis and mitigation

CVE-2026-4723 is a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox and Thunderbird. It affects Firefox versions prior to 149.0 and Thunderbird versions prior to 149, and was disclosed on March 24, 2026 via Mozilla Foundation Security Advisory 2026-20 and 2026-23. The vulnerability was reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic. Mozilla rates its impact as moderate, while Feedly's CVSS v3.1 estimate assigns a base score of 9.8 (Critical) (Mozilla Advisory, Feedly).

The vulnerability is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), occurring within Firefox's JavaScript Engine component (Mozilla bug 2013573). Use-after-free flaws arise when a program continues to reference memory after it has been freed, allowing an attacker to craft malicious JavaScript that triggers the engine to access deallocated memory regions. Exploitation typically involves delivering specially crafted JavaScript content — for example, via a malicious web page — that manipulates object lifetimes in the JS engine to cause a dangling pointer dereference. No specific technical write-up or public PoC code has been identified at this time (Mozilla Advisory, Red Hat Bugzilla).

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code within the context of the Firefox or Thunderbird process, potentially leading to full compromise of the affected system. In Thunderbird, Mozilla notes that scripting is disabled when reading mail, limiting the attack surface to browser or browser-like contexts. The vulnerability could also result in denial of service (application crash) if code execution is not achieved. Data confidentiality, integrity, and availability are all at risk if exploitation succeeds (Mozilla Advisory, Mozilla Thunderbird Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time (Feedly). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (0.000150), indicating a low current probability of exploitation in the wild. The vulnerability was discovered through AI-assisted security research using Anthropic's Claude model, which is a notable aspect of its discovery context (Mozilla Advisory, VulnCheck Blog).

Mozilla has addressed this vulnerability in Firefox 149 and Thunderbird 149, released on March 24, 2026. All users running Firefox or Thunderbird versions prior to 149 should update immediately. No configuration-based workaround is available; upgrading to the patched version is the only recommended remediation. Enterprise administrators should prioritize deploying the update via automated patch management tools (Mozilla Advisory, Mozilla Thunderbird Advisory, Red Hat Bugzilla).

The vulnerability attracted notable attention due to its discovery method: it was found by a team of researchers (Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger) using Anthropic's Claude AI model, representing a prominent example of AI-assisted vulnerability research (Mozilla Advisory). VulnCheck published a blog post specifically discussing CVEs credited to Anthropic, highlighting the broader trend of AI-assisted security research (VulnCheck Blog). Coverage appeared across security news outlets including CyberSecurityNews and The Hacker Wire, and the Firefox 149 release was noted for patching 37 vulnerabilities in total (CyberSecurityNews).