CVE-2026-92015

No known exploitation. EPSS puts it in the 18th percentile. No fix published yet.

CVSS 3.18.8High EPSS percentile18th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your staff use Firefox or Thunderbird and record each installed version.
Update Firefox to 115.41, 140.16, 153.3, or 156, as appropriate for your release branch.
Update Thunderbird to 140.16, 153.3, or 156, as appropriate for your release branch.
Remove unneeded extensions and investigate any extension installed outside your normal approval process.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

In plain language

Written by AI from the record

A malicious browser or email extension can take over Firefox or Thunderbird after a user interacts with a crafted website, so small businesses should update affected installations now.

Privilege escalation in the WebExtensions component lets crafted web content cause a malicious extension to receive excessive permissions and fully compromise the client application.

If you're affected

Full browser takeover
Email client takeover
Email data exposure
Saved-account theft
Business workflow disruption

What is it

This is a flaw in the part of Firefox and Thunderbird that manages add-ons. It is like an untrusted contractor being handed a master key after a staff member follows a convincing instruction: the add-on can then control the whole application.

Who is affected

This matters to you if your business uses Firefox or Thunderbird, especially where staff install or rely on extensions. It is a risk when a user visits and interacts with specially crafted web content that triggers the vulnerable extension feature.

How urgent is it

Attackers can use a malicious extension and crafted web content to take full control of the affected browser or email client. There is no confirmed active exploitation or public exploit code, but the potential impact is severe and the flaw is reachable in normal settings after user interaction.

What to do — in detail

Confirm exposure by inventorying Firefox and Thunderbird versions on managed and unmanaged staff devices, then identify installed extensions and their source. Upgrade Firefox to the applicable fixed branch version: 115.41, 140.16, 153.3, or 156; upgrade Thunderbird to 140.16, 153.3, or 156. Test the update through your normal software-management process; the findings do not identify a breaking-change concern. If updating is delayed, restrict extension installation to approved extensions, remove unapproved extensions, and warn users not to interact with unexpected web prompts or content. There is no CISA KEV due date because this CVE is not listed in KEV. Monitor extension-installation events and investigate unexpected extensions or unusual browser/email-client behavior.

Technical context

CVE-2026-92015 is CVSS 8.8 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), a CWE-269 privilege-escalation issue in WebExtensions. The vector is network-based, requires no authentication, and requires user interaction with crafted web content; default configuration is reachable. It is not in CISA KEV, there is no clear dated report of exploitation in the wild, and no public exploit code is on record. EPSS predicts 0.3% likelihood (20th percentile) with a flat trend; this is predictive rather than evidence of exploitation. Press attention is rising due to roundups.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS18th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 18th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 3 days, from the signal feeds we watch.

2026-09-18OpenVAS check added
2026-09-16Record updatedrecord updated, record updated
2026-09-15Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Mozillaoss-project · USaka mozilla corp.
- FirefoxDesktop AppOn-premConsumer Software / browser
- ThunderbirdDesktop AppOn-premCommunications / email-server-client

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable