CVE-2026-92018 Mozilla CVE debrief

Who should care

Defenders responsible for managing and securing Firefox, Firefox ESR, and Thunderbird installations should assess exposure and prioritize patching due to potential sandbox escapes. This includes reviewing and updating inventory of affected systems, verifying and applying patches, and monitoring for potential exploitation attempts. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should prioritize verifying and applying patches for Firefox, Firefox ESR, and Thunderbird due to a sandbox escape vulnerability. The vulnerability has a CVSS score of 9.6 and a severity of CRITICAL. However, the exact versions affected by this vulnerability and potential exploitation attempts require verification from the supplied official sources.

• Verify and apply patches to prevent potential sandbox escapes
• Monitor for potential exploitation attempts to detect possible attacks
• Review and update inventory of affected systems to ensure comprehensive coverage

Technical summary

A sandbox escape vulnerability in the DOM: Core & HTML component of Firefox, Firefox ESR, and Thunderbird was fixed in multiple versions. The vulnerability has a CVSS score of 9.6 and a severity of CRITICAL. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. However, the exact versions affected by this vulnerability require verification from the supplied official sources. Defenders should prioritize verifying and applying patches for Firefox, Firefox ESR, and Thunderbird, as well as monitoring for potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying and applying patches for Firefox, Firefox ESR, and Thunderbird, as well as monitoring for potential exploitation attempts.

Recommended defensive actions

• Verify and apply patches for Firefox, Firefox ESR, and Thunderbird
• Monitor for potential exploitation attempts
• Review and update inventory of affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. However, the exact versions affected by this vulnerability require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.