CVE-2026-92020

Published: Sep 15, 2026Updated: Sep 16, 2026 Sources: CVE List NVDCWE-120

8.8HIGH

NVD MITRE

Description

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

In plain language

AI Act now

This is a serious flaw in Firefox and Thunderbird that a malicious webpage or message could use to take control of a computer if the user opens it; update to a fixed version now.

Executive summary

A user-assisted, unauthenticated network attack can exploit an out-of-bounds memory error (CWE-120) in the WebRender graphics component to escalate privileges and potentially achieve full system compromise.

If affected, business impact

Full computer takeoverCustomer data exposureRansomware riskBusiness interruption

What to do now

Check the installed version of Firefox or Thunderbird on every business computer.
Update Firefox to 115.41, 140.16, 153.3, or 156 or later, matching your supported release branch.
Update Thunderbird to 140.16, 153.3, or 156 or later, matching your supported release branch.
Until updated, tell staff not to open unexpected links, web pages, or email content.

Usually a quick update

What is it

Firefox and Thunderbird use a graphics feature to display web and email content. A malicious page or message can make that feature mishandle data, like forcing a loading dock door past its safety stop and gaining access to the building behind it.

Who is affected

This matters to you if staff use Firefox or Thunderbird on business computers. It is especially relevant where employees open web links or view email content from outside the business. An attacker needs a user to view content that triggers the WebRender component bug.

How urgent is it

A malicious webpage or message can trigger this flaw after a user opens it, with the potential for full control of the computer. Treat this as urgent because no account is required and a successful attack can affect the whole system. There is no confirmed public exploitation or public exploit code at this time.

What to do — in detail

Confirm exposure by inventorying Firefox and Thunderbird versions across endpoints, including ESR installations. Upgrade Firefox to the applicable fixed branch version: 115.41, 140.16, 153.3, or 156; upgrade Thunderbird to 140.16, 153.3, or 156. Use the normal vendor-supported update path for the release branch already deployed; the findings do not identify a required breaking-change migration. If updates are delayed, reduce exposure by preventing users from opening untrusted links and unexpected email content, especially from external senders. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Monitor endpoint and browser-management reports for devices that remain below the fixed version, and investigate unexpected browser or mail-client crashes after suspicious content is opened.

Technical context

CVSS 3.1: 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The issue is CWE-120, an incorrect boundary-condition memory error in WebRender, reachable through network-delivered content with required user interaction and no authentication. CISA KEV does not list this CVE, news findings contain no clear dated exploitation claim, and no public exploit code is on record. EPSS is 0.3% (20th percentile) with a flat trend; this is a prediction, not evidence of exploitation. Default-configuration reachability is unknown.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-120

Affected Products

Mozilla

oss-project·USaka mozilla corp.

FirefoxOn-premDesktop App

Consumer Software / browser

ThunderbirdOn-premDesktop App

Communications / email-server-client

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-92020?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Initial Access

Privilege Escalation

View detailed technique mapping

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2066329

bugzilla.mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-90/

mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-91/

mozilla.org

and 5 more references View all →

News mentions

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
en·The Hacker News·Sep 21, 2026 Exploited Cisco Identity Services Engine zero-day

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-92020 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows