CVE-2026-92015 is a privilege escalation vulnerability affecting the WebExtensions component of Mozilla Firefox. The flaw allows an attacker to escalate privileges, potentially gaining higher access rights than intended. This issue was addressed and fixed in Firefox 156 and Firefox ESR releases 115.41, 140.16, and 153.3. The vulnerability has a CVSS 3.1 base score of 8.8, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The Mozilla Foundation published advisories MFSA 2026-90 and MFSA 2026-91 detailing this and other vulnerabilities fixed in these releases.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox browser environment, potentially leading to full compromise of the affected process. The CVSS score of 8.8 reflects a high impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild at this time.

This vulnerability has been fixed in Firefox 156 and Firefox ESR versions 115.41, 140.16, and 153.3. Users and administrators should update to these versions or later to remediate this issue. No additional mitigation steps are required beyond applying the official updates.