Skip to main content

Mozilla Firefox CVE-2026-92041

| EUVDEUVD-2026-78504 CRITICAL
Protection Mechanism Failure (CWE-693)
2026-09-15 mozilla GHSA-r253-q3j8-2r7g
Authentication Bypass Red Hat Mozilla Suse
Critical
Disputed · 9.1 Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host malicious web content
  2. Delivery
    Victim's Firefox loads page
  3. Exploit
    Trigger DOM Networking mitigation bypass
  4. Execution
    Defeat security boundary
  5. Impact
    Access/tamper cross-origin data

Vulnerability Assessment

Weakness
CWE
CWE-693
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
Exploitation Conditions

Requires the victim to be running an affected Firefox build (before Firefox 156 or ESR before 153.3) and to load attacker-influenced web content that exercises the DOM: Networking component; the flaw defeats an existing browser mitigation/security boundary rather than granting code execution outright. Limiting factors: it is a client-side browser vulnerability, so in practice the victim must render a malicious page (contradicting the vendor's UI:N); the specific mitigation bypassed is undisclosed, and there is no public exploit, reducing near-term real-world risk despite the high CVSS.
Impact

The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) rates this as critical, remotely reachable, low-complexity, and requiring neither privileges nor user interaction. That UI:N is unusual for a browser DOM/Networking flaw: real-world exploitation of a client-side rendering-engine bug almost always requires the victim to visit or load attacker-controlled web content, which is normally scored UI:R - treat the UI:N as questionable and verify against the Mozilla advisories. The counter-signals argue against emergency priority: EPSS is only 0.16% (6th percentile), the CVE is NOT on CISA KEV, and no public exploit code is identified. CWE-693 (Protection Mechanism Failure) means this is a mitigation/hardening bypass rather than a fresh memory-corruption primitive - its practical value is typically as a defeat of an existing safeguard that must be chained with another bug, which is consistent with the low EPSS. Net: high theoretical severity (C:H/I:H against a ubiquitous browser) but no evidence of active or imminent exploitation. Prioritize via normal browser patch cadence rather than as a fire-drill, while acknowledging Firefox's enormous install base makes patching worthwhile.
Exploit ScenarioDerived

An attacker hosts a malicious web page (or injects content into one the victim loads) that abuses the DOM: Networking mitigation bypass to defeat a browser security boundary and access or tamper with data across origins. No public proof-of-concept is available, and as a client-side flaw it realistically requires the victim to load attacker-controlled content despite the vendor's UI:N scoring.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 21, 2026

Mozilla Firefox builds before 156 (and Firefox ESR builds before 153.3) can be induced to bypass an existing browser security mitigation through attacker-influenced web content that exercises the DOM: Networking component, yielding high confidentiality and integrity impact without granting outright code execution. The vendor rates this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but our independent assessment adjusts the vector to UI:R, since the victim must actually load the malicious page for the bypass to trigger - a normal precondition for a client-side browser flaw. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), so near-term real-world risk is limited despite the critical score.

RemediationAI

Apply the vendor-released patch by upgrading to Firefox 156 or Firefox ESR 153.3, which Mozilla identifies as the fixed releases in advisories mfsa2026-90, mfsa2026-93, mfsa2026-94, and mfsa2026-96. Because the specific mitigation that is bypassed remains undisclosed, no targeted workaround - such as disabling a named feature or blocking a particular port - can be recommended with confidence; generic compensating measures like script-blocking extensions, network-level content filtering, or restricting browsing to trusted sites carry significant usability trade-offs and do not reliably neutralize an unnamed DOM/networking bypass. Prioritize the update on workstations that browse untrusted web content, since exploitation requires the victim to load attacker-influenced pages, and there is no public exploit identified at time of analysis to accelerate the timeline further.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is a Protection Mechanism Failure (CWE-693) located in Firefox's DOM: Networking component, the subsystem that mediates network activity initiated by web content - fetch/XHR requests, Content Security Policy enforcement, CORS checks, mixed-content blocking, and related policy boundaries. Instead of executing code directly, the bug lets a crafted page defeat one of these existing mitigations, which explains why the impact is scored as high confidentiality and integrity loss with no availability component. Mozilla tracks the fix through Bugzilla 2029482 and advisories mfsa2026-90, mfsa2026-93, mfsa2026-94, and mfsa2026-96, but the exact mitigation being bypassed has not been publicly detailed, limiting independent reproduction or verification of the technical root cause. The provided CPE data identifies the affected product simply as mozilla:firefox for all versions in the vulnerable range.

Know when Mozilla gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (mozilla) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 8.1 HIGH

Remote via malicious web content with no privileges, but as a client-side browser DOM flaw it realistically needs the victim to load a page, so UI:R; high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 6.1 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
CVSS changed
Sep 21, 2026 - 18:22 NVD
9.1 (CRITICAL)
CVE Published
Sep 15, 2026 - 12:34 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 15, 2026 - 12:34 cve.org
CRITICAL 9.1

DescriptionCVE.org

Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

Executive ViewAI

Why It Matters

Mozilla Firefox and Firefox ESR versions prior to 156 and 153.3 contain a critical security mitigation bypass that could allow attackers to compromise data confidentiality and integrity via malicious web content. Although no public exploit exists and near-term risk is low, the absence of a vendor patch leaves organizations unable to fully remediate, potentially exposing users to data theft or manipulation. Leadership should prioritize inventory and interim controls while awaiting a patch.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict Firefox/Firefox ESR use to trusted sites, enforce Enhanced Tracking Protection and strict content security policies, disable unnecessary extensions, isolate high-risk browsing in virtual machines or sandboxes, and consider using an alternative browser for sensitive tasks. Monitor Mozilla advisories for updates.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Firefox is a major mainstream browser deployed across consumer and enterprise endpoints worldwide
Data Quality
5 sources
Confidence: Medium
EUVD 🇯🇵JVN NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Mozilla

View all
CVE-2015-4495 HIGH POC
8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2013-0643 HIGH
8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2013-0431 LOW POC
3.7
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/kiosk/firefox-esr:153.3-75.41 Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-92041 ADVISORY https://vuldb.com/vuln/404196 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23918/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4247/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4264/ REF https://bugzilla.mozilla.org/show_bug.cgi?id=2029482 REF https://www.mozilla.org/security/advisories/mfsa2026-90/ REF https://www.mozilla.org/security/advisories/mfsa2026-93/ REF https://www.mozilla.org/security/advisories/mfsa2026-94/ REF https://www.mozilla.org/security/advisories/mfsa2026-96/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy