CVE-2026-92033
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Privilege escalation vulnerability in Firefox for Android. Fixed in Firefox 156.
Risk Assessment
An attacker could exploit this vulnerability to gain elevated privileges on an Android device, potentially leading to unauthorized data access or device control.
Recommendation
Update Firefox for Android to version 156 or later.
Other vulnerabilities in Firefox for Android
See all- CVE-2023-29534Critical
In Firefox and Focus for Android, techniques were discovered to obscure the fullscreen notification, which could lead to user confusion and spoofing attacks. This affects Firefox for Android and Focus for Android versions prior to 112.
- CVE-2026-84117High
Privilege escalation in Firefox for Android. Fixed in Firefox 155.
- CVE-2026-74975Medium
A spoofing issue exists in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
- CVE-2026-18809Medium
Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.
- CVE-2026-16397Medium
Clickjacking vulnerability in the WebExtensions component in Firefox for Android. This issue was fixed in Firefox 153.
- CVE-2026-16373High
Vulnerability in the Privacy component in Firefox for Android. The flaw leads to information disclosure. The issue was fixed in Firefox 153.
- CVE-2023-29546Medium
When recording the screen while in Private Browsing on Firefox for Android, the address bar and keyboard were not hidden, potentially leaking sensitive information. This bug only affects Firefox for Android and Focus for Android versions prior to 112.
- CVE-2023-25747High
Potential use-after-free in libaudio, fixed by disabling AAudio backend on Android below version 30. Affects only Firefox for Android before 110.1.0.
- CVE-2022-38474Medium
A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once permission has been granted. This bug only affects Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 104.
- CVE-2020-26977Medium
By attempting to connect to a website using an unresponsive port, an attacker could control the content of a tab while the URL bar displayed the original domain. Affects Firefox for Android < 84.
Original NVD description (English source)
Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS