CVE-2026-92034

CriticalCVSS 9.1

Published: 15/09/2026(UTC)Updated: 05/10/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

Risk Assessment

A site isolation breach may allow an attacker to access data from other sites, leading to information disclosure. Organizations with unpatched versions are at risk.

Recommendation

Update Firefox and Thunderbird to version 156. Verify that site isolation mechanisms function correctly after the update.

Other vulnerabilities in Firefox

See all

CVE-2026-113470Medium
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on October 17, and the list was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. The vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.
CVE-2026-113401Medium
A denial-of-service vulnerability exists in the PDF Viewer component. The vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
CVE-2026-117997Critical
A use-after-free in the Widget component of Firefox and Thunderbird can lead to a sandbox escape. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117981Critical
Privilege escalation vulnerability in the Toolkit component of Firefox and Thunderbird. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117980Critical
Use-after-free vulnerability in the Graphics component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117971Critical
A use-after-free vulnerability in the Print Preview component of Firefox and Thunderbird allows a sandbox escape. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117962Critical
A sandbox escape caused by incorrect boundary conditions exists in the Storage: Quota Manager component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117946Critical
Incorrect boundary conditions in the JavaScript Engine component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117945Critical
Incorrect boundary conditions exist in the XML component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117920Critical
Use-after-free vulnerability in the DOM: HTML Parser component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Original NVD description (English source)

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS