CVE-2026-92013

No known exploitation. EPSS puts it in the 18th percentile. No fix published yet.

CVSS 3.18.8High EPSS percentile18th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check the installed version of Firefox or Thunderbird on every business computer.
Update Firefox to 156, or to 115.41, 140.16, or 153.3 on the corresponding supported release branch.
Update Thunderbird to 156, or to 140.16 or 153.3 on the corresponding supported release branch.
Until updates are complete, tell staff not to open unexpected links, webpages, or email content.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

In plain language

Written by AI from the record

Older, unpatched Firefox or Thunderbird can let a malicious webpage or email take over a computer after someone opens it, so small businesses should update now.

CanvasWebGL boundary-condition flaw (CWE-120) enables network-delivered arbitrary code execution with full administrative permissions after user interaction.

If you're affected

Full computer takeover
Business data exposure
Ransomware risk
Work disruption

What is it

This is a flaw in the part of Firefox and Thunderbird that draws web graphics. A malicious page or email can use it like finding a gap in a building’s security fence, then use that gap to gain control of the whole building.

Who is affected

This matters to you if employees use Firefox or Thunderbird on business computers. It is a risk when a user opens a malicious webpage or an email containing specially crafted graphics content.

How urgent is it

An attacker can use a malicious webpage or email to take control of a computer after a user opens it. Although no confirmed real-world exploitation or public exploit code is reported, the potential for full administrative control makes this a red-priority update.

What to do — in detail

Confirm exposure by inventorying Firefox and Thunderbird versions across managed endpoints and identifying devices below their supported fixed release. Upgrade Firefox to 156, Firefox ESR 115.41, Firefox ESR 140.16, or Firefox ESR 153.3, as appropriate for the deployed branch; upgrade Thunderbird to 156, 140.16, or 153.3 for the deployed branch. Use the normal vendor update channel and test any managed extension or policy compatibility before broad deployment where required. If patching is delayed, restrict access to untrusted websites and instruct users not to open unexpected email links or content; this reduces exposure but does not remove the vulnerability. CISA has not assigned a KEV remediation due date. Monitor update-management reports for successful installation and investigate endpoint alerts or crashes associated with suspicious webpages or email content.

Technical context

CVE-2026-92013 is rated CVSS 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). It is a CWE-120 memory-boundary issue in Graphics: CanvasWebGL, reachable in default configuration through crafted web or email content and requiring user interaction. The findings describe arbitrary code execution with full administrative permissions. It is not listed in CISA KEV, no clear dated in-the-wild exploitation claim is available, and no public exploit code is recorded. EPSS is 0.3% at the 20th percentile with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS18th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 18th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 3 days, from the signal feeds we watch.

2026-09-18OpenVAS check added
2026-09-16Record updatedrecord updated, record updated
2026-09-15Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Mozillaoss-project · USaka mozilla corp.
- FirefoxDesktop AppOn-premConsumer Software / browser
- ThunderbirdDesktop AppOn-premCommunications / email-server-client

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable