CVE-2026-92060
Low risk· EPSS 4%Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Use-after-free in the Internationalization component of Firefox and Thunderbird. This could lead to a crash or potential code execution.
Risk Assessment
An attacker could cause a crash or potentially execute arbitrary code in the context of the victim.
Recommendation
Update Firefox or Thunderbird to the patched version (156, 153.3, or later).
Other vulnerabilities in Mozilla Firefox / Mozilla Thunderbird
See all- CVE-2026-92065Low risk· EPSS 4%
Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92064Low risk· EPSS 4%
Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92059Low risk· EPSS 4%
Incorrect boundary conditions in the DOM: Editor component, which could lead to unexpected behavior or security bypass. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92058Low risk· EPSS 4%
Use-after-free in the Graphics component, which could allow an attacker to execute code or cause a crash. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92056Low risk· EPSS 4%
Use-after-free in the Graphics: Text component, which could lead to a crash or code execution. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92049Low risk· EPSS 4%
Use-after-free in the Widget: Win32 component, which could allow code execution or lead to a crash. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Original NVD description (English source)
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.