CVE-2026-92060
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Use-after-free in the Internationalization component of Firefox and Thunderbird. This could lead to a crash or potential code execution.
Risk Assessment
An attacker could cause a crash or potentially execute arbitrary code in the context of the victim.
Recommendation
Update Firefox or Thunderbird to the patched version (156, 153.3, or later).
Other vulnerabilities in Mozilla Firefox / Mozilla Thunderbird
See all- CVE-2026-92059Critical
Incorrect boundary conditions in the DOM: Editor component, which could lead to unexpected behavior or security bypass. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92065High
Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92064High
Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92058High
Use-after-free in the Graphics component, which could allow an attacker to execute code or cause a crash. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92056High
Use-after-free in the Graphics: Text component, which could lead to a crash or code execution. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92049High
Use-after-free in the Widget: Win32 component, which could allow code execution or lead to a crash. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Original NVD description (English source)
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS