CVE-2026-92029

This is a flaw in how Firefox and Thunderbird handle a type of image content. A malicious website or message can act like a booby-trapped document: opening it may let an attacker take control of the computer rather than merely displaying the content.

This matters to you if employees use Firefox or Thunderbird on business computers. An attacker does not need an account, but someone must interact with malicious content for the attack to work.

Attackers can use a malicious website or message to target a staff member and potentially take control of their computer. Treat this as urgent because successful attacks can expose business data and install malware, even though no confirmed real-world exploitation or public exploit code is currently reported.

1. Inventory installed Firefox and Thunderbird versions across managed and unmanaged business devices, including remote workers.
2. Upgrade Firefox on the applicable branch to at least 115.41, 140.16, 153.3, or 156; upgrade Thunderbird on the applicable branch to at least 140.16, 153.3, or 156.
3. Use the normal Mozilla or operating-system update process and restart the application after installation. The findings do not identify a breaking-change requirement.
4. If patching is delayed, reduce exposure by warning users not to open unexpected links, attachments, or untrusted web content; this is only a temporary safeguard because user interaction is the attack trigger.
5. Check endpoint security alerts for browser or email-client crashes and unexpected child processes following Firefox or Thunderbird activity. CISA has not added this CVE to KEV, so there is no CISA remediation due date.

Severity is CVSS 8.8 (High), with network attack vector, low attack complexity, no privileges required, and user interaction required. The weakness is CWE-416, a use-after-free in the SVG component, with potential arbitrary code execution and confidentiality, integrity, and availability impact. CISA KEV does not list this CVE; no public exploit code or clear dated reporting of in-the-wild exploitation is available. EPSS is 0.3% (28th percentile) and flat; this is a prediction, not evidence of exploitation.