CVE-2026-92040
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Risk Assessment
Exploitation could lead to arbitrary code execution or application crashes, threatening the security of the user's workstation.
Recommendation
Update Firefox to version 156 or later and Thunderbird to version 156 or later.
Other vulnerabilities in Firefox JavaScript: WebAssembly
See all- CVE-2026-100792Unknown
A JIT miscompilation in the JavaScript: WebAssembly component of Firefox. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100788Unknown
An invalid pointer in the JavaScript: WebAssembly component of Firefox. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
Original NVD description (English source)
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS