Nixpkgs security tracker

Try the new UI
Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2026-92040
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

Affected products

Firefox
  • =<*
Thunderbird
  • =<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.3

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -

pkgs.firefox-gnome-theme

GNOME theme for Firefox

  • nixos-unstable -
    • nixos-unstable-small 150
  • nixos-26.05 -
    • nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable -
    • nixos-unstable-small 7
  • nixos-26.05 -
    • nixos-26.05-small 7

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 4

Package maintainers

Permalink CVE-2026-92238
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
Ambiguous parsing of mail headers

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.

Affected products

Thunderbird
  • =<*
  • =<140.*

Matching in nixpkgs

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

Package maintainers

Permalink CVE-2026-92076
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
Incorrect boundary conditions in the Networking component

Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.

Affected products

Firefox
  • =<153.*
  • =<*
Thunderbird
  • =<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.3

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -

pkgs.firefox-gnome-theme

GNOME theme for Firefox

  • nixos-unstable -
    • nixos-unstable-small 150
  • nixos-26.05 -
    • nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable -
    • nixos-unstable-small 7
  • nixos-26.05 -
    • nixos-26.05-small 7

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 4

Package maintainers

Permalink CVE-2026-91733
8.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
Improper state validation in Skia in Google Chrome prior to …

Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected products

Chrome
  • <153.0.8010.47

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small

pkgs.mkchromecast

Cast macOS and Linux Audio/Video to your Google Cast and Sonos Devices

pkgs.chrome-export

Scripts to save Google Chrome's bookmarks and history as HTML bookmarks files

  • nixos-unstable -
    • nixos-unstable-small 2.0.2
  • nixos-26.05 -
    • nixos-26.05-small 2.0.2

pkgs.go-chromecast

CLI for Google Chromecast, Home devices and Cast Groups

  • nixos-unstable -
    • nixos-unstable-small 0.3.4
  • nixos-26.05 -
    • nixos-26.05-small 0.3.4

pkgs.xf86videoopenchrome

VIA Technologies UniChrome and Chrome9 IGP video driver for the Xorg X server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.chrome-token-signing

Chrome and Firefox extension for signing with your eID on the web

  • nixos-unstable -
    • nixos-unstable-small 1.1.5
  • nixos-26.05 -
    • nixos-26.05-small 1.1.5

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

  • nixos-unstable -
  • nixos-26.05 -

pkgs.xf86-video-openchrome

VIA Technologies UniChrome and Chrome9 IGP video driver for the Xorg X server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gnomeExtensions.monochrome-toggle

Quick Settings toggle for monochrome, desatured or sepia tinted display. Based on Achroma.

  • nixos-unstable -
    • nixos-unstable-small 1
Permalink CVE-2026-55863
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.

Affected products

motioneye
  • ==< 0.44.0

Matching in nixpkgs

pkgs.motioneye

Web frontend for the motion daemon

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers

Permalink CVE-2026-91782
1.9 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference

A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.48 addresses this issue. The patch is identified as d1268210b6f6/471130b39c0/283d3198bed/0a84e560216/a692a633d40. Upgrading the affected component is recommended.

Affected products

Binutils
  • ==2.48
  • ==2.47

Matching in nixpkgs

pkgs.bintools

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.bintoolsNoLibc

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutilsNoLibc

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.cargo-binutils

Cargo subcommands to invoke the LLVM tools shipped with the Rust toolchain

  • nixos-unstable -
    • nixos-unstable-small 0.4.0
  • nixos-26.05 -
    • nixos-26.05-small 0.4.0

pkgs.binutils_nogold

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.darwin.binutils

System binary utilities (wrapper script)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.bintools-unwrapped

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils-unwrapped

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils-unwrapped_2_38

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.38
  • nixos-26.05 -
    • nixos-26.05-small 2.38
Permalink CVE-2026-91956
7.1 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client.

Affected products

FreeRDP
  • ==3.31.0
  • <3.31.0

Matching in nixpkgs

pkgs.freerdp

Remote Desktop Protocol Client

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers

Permalink CVE-2026-92028
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.

Affected products

Firefox
  • =<115.*
  • =<153.*
  • =<140.*
  • =<*
Thunderbird
  • =<*
  • =<140.*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.3

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox-gnome-theme

GNOME theme for Firefox

  • nixos-unstable -
    • nixos-unstable-small 150
  • nixos-26.05 -
    • nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable -
    • nixos-unstable-small 7
  • nixos-26.05 -
    • nixos-26.05-small 7

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 4

Package maintainers

Permalink CVE-2026-92059
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
Incorrect boundary conditions in the DOM: Editor component

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.

Affected products

Firefox
  • =<153.*
  • =<*
Thunderbird
  • =<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.3

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox-gnome-theme

GNOME theme for Firefox

  • nixos-unstable -
    • nixos-unstable-small 150
  • nixos-26.05 -
    • nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable -
    • nixos-unstable-small 7
  • nixos-26.05 -
    • nixos-26.05-small 7

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 4

Package maintainers

Permalink CVE-2026-91748
8.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
Race condition in Extensions in Google Chrome on on Mac …

Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)

Affected products

Chrome
  • <153.0.8010.47

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small

pkgs.mkchromecast

Cast macOS and Linux Audio/Video to your Google Cast and Sonos Devices

pkgs.chrome-export

Scripts to save Google Chrome's bookmarks and history as HTML bookmarks files

  • nixos-unstable -
    • nixos-unstable-small 2.0.2
  • nixos-26.05 -
    • nixos-26.05-small 2.0.2

pkgs.go-chromecast

CLI for Google Chromecast, Home devices and Cast Groups

  • nixos-unstable -
    • nixos-unstable-small 0.3.4
  • nixos-26.05 -
    • nixos-26.05-small 0.3.4

pkgs.xf86videoopenchrome

VIA Technologies UniChrome and Chrome9 IGP video driver for the Xorg X server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.chrome-token-signing

Chrome and Firefox extension for signing with your eID on the web

  • nixos-unstable -
    • nixos-unstable-small 1.1.5
  • nixos-26.05 -
    • nixos-26.05-small 1.1.5

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

  • nixos-unstable -
  • nixos-26.05 -

pkgs.xf86-video-openchrome

VIA Technologies UniChrome and Chrome9 IGP video driver for the Xorg X server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gnomeExtensions.monochrome-toggle

Quick Settings toggle for monochrome, desatured or sepia tinted display. Based on Achroma.

  • nixos-unstable -
    • nixos-unstable-small 1