CVE-2026-92034

No known exploitation. EPSS puts it in the 19th percentile. No fix published yet.

CVSS 3.19.1Critical EPSS percentile19th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check the installed version of Firefox or Thunderbird in its About screen.
Update Firefox to version 156 or later.
Update Thunderbird to version 156 or later.
Restart the application after the update and confirm the new version number.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

In plain language

Written by AI from the record

Update Firefox or Thunderbird if it is earlier than version 156: this flaw can let an attacker break the separation between websites and take control of the application.

Unauthenticated network-reachable site-isolation bypass in the Graphics component enables cross-site security-boundary compromise with high integrity and availability impact.

If you're affected

Browser content manipulation
Service disruption
Cross-site boundary bypass
Potential privacy compromise

What is it

Browsers are supposed to keep each website in its own separate room. This flaw is like a faulty dividing wall that can let an outsider cross between rooms, alter what the browser does, and disrupt its operation.

Who is affected

This matters to you if your business uses Firefox or Thunderbird on employee devices. It is a risk in the normal configuration because the affected graphics feature is reachable by default and an attacker does not need a login or employee action.

How urgent is it

An attacker can target this remotely without a login or employee interaction, and the flaw can bypass the browser’s separation between websites. Treat this as urgent and complete the update promptly, even though no confirmed real-world exploitation has been reported.

What to do — in detail

Confirm exposure by checking installed versions through each application’s About screen or your device-management inventory. Firefox 156 and Thunderbird 156 contain the fix; update any earlier installations using your normal vendor update channel, then restart and verify the installed version.

No public exploit code or confirmed active exploitation is recorded, but this is reachable in the default configuration and requires no authentication. If patching must wait, limit use of the affected application on untrusted websites and restrict access to unnecessary web content until the update is deployed. Monitor update-deployment reports and browser or mail-client crash and security alerts for affected devices. CISA has not listed this CVE in its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date.

Technical context

CVSS 3.1 is 9.1 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The weakness is CWE-346, involving inadequate site isolation in the Graphics component; it is network-reachable in the default configuration with no authentication or user interaction required. No public exploit code is on record, CISA KEV does not list it, and press reporting contains no clear dated claim of exploitation. EPSS is 0.1% (5th percentile) with a flat trend; this is a prediction rather than evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS19th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 19th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 6 days, from the signal feeds we watch.

2026-09-21Record updated
2026-09-18OpenVAS check added
2026-09-16Record updated
2026-09-15Publishedweakness classified, record updated, record updated

Affected products

Mozillaoss-project · USaka mozilla corp.
- FirefoxDesktop AppOn-premConsumer Software / browser
- ThunderbirdDesktop AppOn-premCommunications / email-server-client

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-346No name in the record

Sources

References in the record

In the news

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser HijacksThe Hacker News · 2026-09-21

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Firefox, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account