CVE-2026-92048
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Risk Assessment
A sandbox escape may allow code execution outside the isolated environment, increasing the risk of system compromise.
Recommendation
Update Firefox and Thunderbird to the latest versions listed in the vulnerability description.
Other vulnerabilities in Firefox
See all- CVE-2026-113470Medium
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on October 17, and the list was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. The vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.
- CVE-2026-113401Medium
A denial-of-service vulnerability exists in the PDF Viewer component. The vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
- CVE-2026-117997Critical
A use-after-free in the Widget component of Firefox and Thunderbird can lead to a sandbox escape. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117981Critical
Privilege escalation vulnerability in the Toolkit component of Firefox and Thunderbird. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117980Critical
Use-after-free vulnerability in the Graphics component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117971Critical
A use-after-free vulnerability in the Print Preview component of Firefox and Thunderbird allows a sandbox escape. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117962Critical
A sandbox escape caused by incorrect boundary conditions exists in the Storage: Quota Manager component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117946Critical
Incorrect boundary conditions in the JavaScript Engine component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117945Critical
Incorrect boundary conditions exist in the XML component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117920Critical
Use-after-free vulnerability in the DOM: HTML Parser component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Original NVD description (English source)
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS