CVE-2026-92022

No known exploitation. EPSS puts it in the 25th percentile. No fix published yet.

CVSS 3.18.8High EPSS percentile25th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-20Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check the version of Firefox and Thunderbird installed on every business computer.
Update Firefox to 156, or the supported ESR fix for your branch: 115.41, 140.16, or 153.3.
Update Thunderbird to 156, or the supported branch fix: 140.16 or 153.3.
Until updates are complete, tell staff not to open unexpected links, websites, or HTML email content.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

In plain language

Written by AI from the record

Firefox and Thunderbird versions before the listed fixes can be taken over after a user opens a malicious webpage or message; small businesses should treat updating as urgent.

Use-after-free in the DOM HTML Parser allows arbitrary code execution through attacker-controlled HTML content after user interaction.

If you're affected

Browser or email takeover
Customer data exposure
Account theft
Ransomware risk
Business interruption

What is it

This is a flaw in how Firefox and Thunderbird process webpage-style content. A malicious page or message can make the application lose track of data in memory, like a receptionist handing a stranger the keys to an office that is no longer assigned, allowing the stranger to take control.

Who is affected

This matters to you if your business uses Firefox or Thunderbird on staff computers. It affects versions released before the listed fixes, and an attacker needs a person to open malicious web content; no login is required.

How urgent is it

Attackers can use malicious web content to take control of the affected application after a staff member opens it. Treat this as urgent and complete updates promptly; there is no confirmed public exploitation report or CISA known-exploited listing at this time.

What to do — in detail

Inventory installed Firefox and Thunderbird versions across managed and unmanaged business devices, including remote workers.
For Firefox, move the applicable release branch to 156, Firefox ESR 115.41, Firefox ESR 140.16, or Firefox ESR 153.3. For Thunderbird, move to 156, 140.16, or 153.3.
Use the normal vendor updater or managed software-deployment tool. These are maintenance updates; the findings do not identify a breaking-change requirement.
If patching is delayed, restrict use of the affected applications for untrusted websites, links, and HTML messages, especially from unexpected senders. This reduces exposure but is not a substitute for updating.
There is no CISA KEV due date because this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. Investigate unexpected Firefox or Thunderbird crashes around suspicious content and confirm the updated version remains installed.

Technical context

CVSS 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-416 use-after-free in the DOM HTML Parser; network-delivered attacker-controlled content can cause application crash or arbitrary code execution, with user interaction required and no authentication required. No public exploit code is on record, CISA KEV does not list this CVE, and no dated reporting confirms exploitation. EPSS is 0.3% (28th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS25th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 25th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising, driven by in-the-wild reports.

Lifecycle

9 events over 5 days, from the signal feeds we watch.

2026-09-20Record updated
2026-09-18OpenVAS check added
2026-09-16Record updatedrecord updated
2026-09-15Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Mozillaoss-project · USaka mozilla corp.
- FirefoxDesktop AppOn-premConsumer Software / browser
- ThunderbirdDesktop AppOn-premCommunications / email-server-client

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable