Threat database

CVE-2026-92027 is a use-after-free vulnerability in the DOM: Streams component of the mozjs52 JavaScript engine used by Firefox and Thunderbird. This vulnerability allows for potential memory corruption and could lead to high impact consequences such as code execution or application crashes. The issue has been fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92015 is a high-impact privilege escalation vulnerability in the WebExtensions component of Mozilla products. It affects multiple versions of Firefox and Thunderbird prior to the fixed releases. The issue allows an attacker to escalate privileges within the affected software. Mozilla has released official fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92023 is a use-after-free vulnerability in the XML component of the mozjs52 JavaScript engine. This vulnerability has been fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability has a high impact and a CVSS score of 8.8, indicating it can lead to high confidentiality, integrity, and availability impacts. Multiple specific vulnerable versions are identified, including various Ubuntu package versions. The vendor has released official fixes for this issue.

CVE-2026-92021 is a use-after-free vulnerability in the JavaScript Engine's JIT component of mozjs52. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16. It has a high impact rating with a CVSS score of 8.8, indicating potential for significant confidentiality, integrity, and availability impact. The vulnerability affects multiple specific versions of mozjs52 as listed, including various Ubuntu package versions. No known exploits in the wild have been reported. The vendor advisory confirms the availability of an official fix.

CVE-2026-92029 is a use-after-free vulnerability in the SVG component of the mozjs52 JavaScript engine used by Firefox and Thunderbird. This flaw was addressed in Firefox 156 and several ESR and Thunderbird versions. The vulnerability has a high impact score and can lead to significant confidentiality, integrity, and availability issues if exploited.

CVE-2026-92022 is a use-after-free vulnerability in the DOM: HTML Parser component of mozjs52, affecting Firefox and Thunderbird products. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability has a high impact and a CVSS score of 8.8, indicating it can lead to high confidentiality, integrity, and availability impacts. Multiple specific vulnerable versions are identified, including various Ubuntu package versions. The vendor has released official fixes for this issue.

CVE-2026-92024 is a use-after-free vulnerability in the SVG component of mozjs52. This flaw was addressed and fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability has a high impact rating and a CVSS score of 8.8, indicating it can lead to significant confidentiality, integrity, and availability issues if exploited.

CVE-2026-92017 is a privilege escalation vulnerability in the DOM Service Workers component of mozjs52. It allows an attacker to escalate privileges within affected Firefox and Thunderbird versions. The vulnerability has been fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92028 is a use-after-free vulnerability in the DOM: Core & HTML component of the mozjs52 engine. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability has a high impact with a CVSS score of 8.8, indicating it can lead to high confidentiality, integrity, and availability impacts. The vendor advisory confirms the issue is addressed in the specified fixed versions.

Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.

Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.