CVE-2026-92034

Browsers are supposed to keep each website in its own separate room. This flaw is like a faulty dividing wall that can let an outsider cross between rooms, alter what the browser does, and disrupt its operation.

This matters to you if your business uses Firefox or Thunderbird on employee devices. It is a risk in the normal configuration because the affected graphics feature is reachable by default and an attacker does not need a login or employee action.

An attacker can target this remotely without a login or employee interaction, and the flaw can bypass the browser’s separation between websites. Treat this as urgent and complete the update promptly, even though no confirmed real-world exploitation has been reported.

Confirm exposure by checking installed versions through each application’s About screen or your device-management inventory. Firefox 156 and Thunderbird 156 contain the fix; update any earlier installations using your normal vendor update channel, then restart and verify the installed version.

No public exploit code or confirmed active exploitation is recorded, but this is reachable in the default configuration and requires no authentication. If patching must wait, limit use of the affected application on untrusted websites and restrict access to unnecessary web content until the update is deployed. Monitor update-deployment reports and browser or mail-client crash and security alerts for affected devices. CISA has not listed this CVE in its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date.

CVSS 3.1 is 9.1 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The weakness is CWE-346, involving inadequate site isolation in the Graphics component; it is network-reachable in the default configuration with no authentication or user interaction required. No public exploit code is on record, CISA KEV does not list it, and press reporting contains no clear dated claim of exploitation. EPSS is 0.1% (5th percentile) with a flat trend; this is a prediction rather than evidence of exploitation.