CVE-2026-92015

Published: Sep 15, 2026Updated: Sep 16, 2026 Sources: CVE List NVDCWE-269

8.8HIGH

NVD MITRE

Description

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

In plain language

AI Act now

A malicious browser or email extension can take over Firefox or Thunderbird after a user interacts with a crafted website, so small businesses should update affected installations now.

Executive summary

Privilege escalation in the WebExtensions component lets crafted web content cause a malicious extension to receive excessive permissions and fully compromise the client application.

If affected, business impact

Full browser takeoverEmail client takeoverEmail data exposureSaved-account theftBusiness workflow disruption

What to do now

Check whether your staff use Firefox or Thunderbird and record each installed version.
Update Firefox to 115.41, 140.16, 153.3, or 156, as appropriate for your release branch.
Update Thunderbird to 140.16, 153.3, or 156, as appropriate for your release branch.
Remove unneeded extensions and investigate any extension installed outside your normal approval process.

Usually a quick update

What is it

This is a flaw in the part of Firefox and Thunderbird that manages add-ons. It is like an untrusted contractor being handed a master key after a staff member follows a convincing instruction: the add-on can then control the whole application.

Who is affected

This matters to you if your business uses Firefox or Thunderbird, especially where staff install or rely on extensions. It is a risk when a user visits and interacts with specially crafted web content that triggers the vulnerable extension feature.

How urgent is it

Attackers can use a malicious extension and crafted web content to take full control of the affected browser or email client. There is no confirmed active exploitation or public exploit code, but the potential impact is severe and the flaw is reachable in normal settings after user interaction.

What to do — in detail

Confirm exposure by inventorying Firefox and Thunderbird versions on managed and unmanaged staff devices, then identify installed extensions and their source. Upgrade Firefox to the applicable fixed branch version: 115.41, 140.16, 153.3, or 156; upgrade Thunderbird to 140.16, 153.3, or 156. Test the update through your normal software-management process; the findings do not identify a breaking-change concern. If updating is delayed, restrict extension installation to approved extensions, remove unapproved extensions, and warn users not to interact with unexpected web prompts or content. There is no CISA KEV due date because this CVE is not listed in KEV. Monitor extension-installation events and investigate unexpected extensions or unusual browser/email-client behavior.

Technical context

CVE-2026-92015 is CVSS 8.8 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), a CWE-269 privilege-escalation issue in WebExtensions. The vector is network-based, requires no authentication, and requires user interaction with crafted web content; default configuration is reachable. It is not in CISA KEV, there is no clear dated report of exploitation in the wild, and no public exploit code is on record. EPSS predicts 0.3% likelihood (20th percentile) with a flat trend; this is predictive rather than evidence of exploitation. Press attention is rising due to roundups.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-269

Affected Products

Mozilla

oss-project·USaka mozilla corp.

FirefoxOn-premDesktop App

Consumer Software / browser

ThunderbirdOn-premDesktop App

Communications / email-server-client

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-92015?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Privilege Escalation

View detailed technique mapping

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2060235

bugzilla.mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-90/

mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-91/

mozilla.org

and 5 more references View all →

News mentions

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
en·The Hacker News·Sep 21, 2026 Exploited Cisco Identity Services Engine zero-day

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-92015 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows