CVE-2026-92049
Low risk· EPSS 4%Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Use-after-free in the Widget: Win32 component, which could allow code execution or lead to a crash. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Risk Assessment
An attacker could exploit the flaw to take control of the process or cause a crash.
Recommendation
Update to a patched version (156 or later).
Other vulnerabilities in Mozilla Firefox / Mozilla Thunderbird
See all- CVE-2026-92065Low risk· EPSS 4%
Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92064Low risk· EPSS 4%
Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92060Low risk· EPSS 4%
Use-after-free in the Internationalization component of Firefox and Thunderbird. This could lead to a crash or potential code execution.
- CVE-2026-92059Low risk· EPSS 4%
Incorrect boundary conditions in the DOM: Editor component, which could lead to unexpected behavior or security bypass. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92058Low risk· EPSS 4%
Use-after-free in the Graphics component, which could allow an attacker to execute code or cause a crash. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92056Low risk· EPSS 4%
Use-after-free in the Graphics: Text component, which could lead to a crash or code execution. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Original NVD description (English source)
Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.