CVE-2026-92013

This is a flaw in the part of Firefox and Thunderbird that draws web graphics. A malicious page or email can use it like finding a gap in a building’s security fence, then use that gap to gain control of the whole building.

This matters to you if employees use Firefox or Thunderbird on business computers. It is a risk when a user opens a malicious webpage or an email containing specially crafted graphics content.

An attacker can use a malicious webpage or email to take control of a computer after a user opens it. Although no confirmed real-world exploitation or public exploit code is reported, the potential for full administrative control makes this a red-priority update.

Confirm exposure by inventorying Firefox and Thunderbird versions across managed endpoints and identifying devices below their supported fixed release. Upgrade Firefox to 156, Firefox ESR 115.41, Firefox ESR 140.16, or Firefox ESR 153.3, as appropriate for the deployed branch; upgrade Thunderbird to 156, 140.16, or 153.3 for the deployed branch. Use the normal vendor update channel and test any managed extension or policy compatibility before broad deployment where required. If patching is delayed, restrict access to untrusted websites and instruct users not to open unexpected email links or content; this reduces exposure but does not remove the vulnerability. CISA has not assigned a KEV remediation due date. Monitor update-management reports for successful installation and investigate endpoint alerts or crashes associated with suspicious webpages or email content.

CVE-2026-92013 is rated CVSS 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). It is a CWE-120 memory-boundary issue in Graphics: CanvasWebGL, reachable in default configuration through crafted web or email content and requiring user interaction. The findings describe arbitrary code execution with full administrative permissions. It is not listed in CISA KEV, no clear dated in-the-wild exploitation claim is available, and no public exploit code is recorded. EPSS is 0.3% at the 20th percentile with a flat trend.