PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92066 Mozilla CVE debrief

A sandbox escape vulnerability was found in the Profile Backup component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 156 and Thunderbird 156. Defenders responsible for managing Firefox and Thunderbird deployments, especially in environments where the Profile Backup component is used, should assess exposure and apply patches. This vulnerability could potentially allow an attacker to execute arbitrary code or access sensitive data. Verification of exposure and patching are crucial to prevent potential exploitation.

Vendor
Mozilla
Product
Firefox
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-15
Original CVE updated
2026-09-21
Advisory published
2026-09-15
Advisory updated
2026-09-21

Who should care

Defenders responsible for managing Firefox and Thunderbird deployments, especially in environments where the Profile Backup component is used, should assess exposure and apply patches.

Why it matters

A sandbox escape vulnerability in the Profile Backup component of Firefox and Thunderbird requires verification of exposure and prompt patching to prevent potential exploitation.

  • Potential sandbox escape could allow attackers to execute arbitrary code.
  • Exposure could lead to unauthorized access to sensitive data.
  • Verification of exposure and patching are crucial to prevent potential exploitation.

Technical summary

The vulnerability allows for a sandbox escape in the Profile Backup component of Firefox and Thunderbird. This could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability was fixed in Firefox 156 and Thunderbird 156. The source confidence is limited, and defenders should verify exposure and apply patches to prevent potential exploitation.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Firefox and Thunderbird, especially in environments where the Profile Backup component is used.

Recommended defensive actions

  • Verify exposure by checking Firefox and Thunderbird versions, especially in environments where the Profile Backup component is used.
  • Apply patches for Firefox 156 and Thunderbird 156.
  • Monitor for potential exploitation attempts.

Evidence notes

The vulnerability was reported by [email protected] and fixed in Firefox 156 and Thunderbird 156. The NVD entry is currently Awaiting Analysis. The CVE record was published on 2026-09-15T13:17:01.283Z and has not been modified since then. The vulnerability allows for a sandbox escape in the Profile Backup component of Firefox and Thunderbird. This could potentially allow an attacker to execute arbitrary code or access sensitive data. The source confidence is limited, and defenders

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92066 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92066

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92066 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92066

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.