CVE-2026-92018
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Sandbox escape vulnerability in the DOM: Core & HTML component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Risk Assessment
A sandbox escape may allow code execution outside the browser's isolated environment, increasing the risk of user system compromise.
Recommendation
Update Firefox and Thunderbird to the latest versions listed in the vulnerability description.
Other vulnerabilities in Firefox
See all- CVE-2026-113470Medium
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on October 17, and the list was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. The vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.
- CVE-2026-113401Medium
A denial-of-service vulnerability exists in the PDF Viewer component. The vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
- CVE-2026-117946Critical
Incorrect boundary conditions in the JavaScript Engine component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117945Critical
Incorrect boundary conditions exist in the XML component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117920Critical
Use-after-free vulnerability in the DOM: HTML Parser component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117917Critical
Invalid pointer vulnerability in the Graphics: WebRender component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117868Critical
Sandbox escape vulnerability in the DOM: Networking component of Firefox and Thunderbird. It may allow bypassing process isolation mechanisms. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117862Critical
Privilege escalation vulnerability due to incorrect boundary conditions in the Networking component of Firefox and Thunderbird. It may allow gaining higher privileges within the process. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117861Critical
Sandbox escape vulnerability in the DOM: Navigation component of Firefox and Thunderbird. It may allow bypassing process isolation and gaining higher privileges. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-109780Critical
Vulnerability in the DOM: Core & HTML component allows mitigation bypass. This issue was fixed in Firefox 158 and Thunderbird 158.
Original NVD description (English source)
Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS