CVE-2026-92022

Published: Sep 15, 2026Updated: Sep 20, 2026 Sources: CVE List NVDCWE-416

8.8HIGH

NVD MITRE

Description

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

In plain language

AI Act now

Firefox and Thunderbird versions before the listed fixes can be taken over after a user opens a malicious webpage or message; small businesses should treat updating as urgent.

Executive summary

Use-after-free in the DOM HTML Parser allows arbitrary code execution through attacker-controlled HTML content after user interaction.

If affected, business impact

Browser or email takeoverCustomer data exposureAccount theftRansomware riskBusiness interruption

What to do now

Check the version of Firefox and Thunderbird installed on every business computer.
Update Firefox to 156, or the supported ESR fix for your branch: 115.41, 140.16, or 153.3.
Update Thunderbird to 156, or the supported branch fix: 140.16 or 153.3.
Until updates are complete, tell staff not to open unexpected links, websites, or HTML email content.

Usually a quick update

What is it

This is a flaw in how Firefox and Thunderbird process webpage-style content. A malicious page or message can make the application lose track of data in memory, like a receptionist handing a stranger the keys to an office that is no longer assigned, allowing the stranger to take control.

Who is affected

This matters to you if your business uses Firefox or Thunderbird on staff computers. It affects versions released before the listed fixes, and an attacker needs a person to open malicious web content; no login is required.

How urgent is it

Attackers can use malicious web content to take control of the affected application after a staff member opens it. Treat this as urgent and complete updates promptly; there is no confirmed public exploitation report or CISA known-exploited listing at this time.

What to do — in detail

Inventory installed Firefox and Thunderbird versions across managed and unmanaged business devices, including remote workers.
For Firefox, move the applicable release branch to 156, Firefox ESR 115.41, Firefox ESR 140.16, or Firefox ESR 153.3. For Thunderbird, move to 156, 140.16, or 153.3.
Use the normal vendor updater or managed software-deployment tool. These are maintenance updates; the findings do not identify a breaking-change requirement.
If patching is delayed, restrict use of the affected applications for untrusted websites, links, and HTML messages, especially from unexpected senders. This reduces exposure but is not a substitute for updating.
There is no CISA KEV due date because this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. Investigate unexpected Firefox or Thunderbird crashes around suspicious content and confirm the updated version remains installed.

Technical context

CVSS 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-416 use-after-free in the DOM HTML Parser; network-delivered attacker-controlled content can cause application crash or arbitrary code execution, with user interaction required and no authentication required. No public exploit code is on record, CISA KEV does not list this CVE, and no dated reporting confirms exploitation. EPSS is 0.3% (28th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-416

Affected Products

Mozilla

oss-project·USaka mozilla corp.

FirefoxOn-premDesktop App

Consumer Software / browser

ThunderbirdOn-premDesktop App

Communications / email-server-client

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-92022?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Initial Access

Privilege Escalation

View detailed technique mapping

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2068059

bugzilla.mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-90/

mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-91/

mozilla.org

and 5 more references View all →

News mentions

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
en·The Hacker News·Sep 21, 2026 Exploited Cisco Identity Services Engine zero-day

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-92022 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows