CVE-2026-92035 – Mozilla Firefox

CVSS 9.6 CRITICAL [2] Critical – Same Day Deployment

“Thirty-three critical flaws, one browser, and every sandbox wall in question: the browser is the front door, so treat this as a lock change, not a routine patch.”

Mozilla has fixed 33 Critical vulnerabilities in Firefox, and the same fixes reach Firefox ESR and Thunderbird. Most of these flaws are sandbox escapes in core components such as DOM, Graphics, WebRender, WebRTC, XPCOM, XUL, Widget: Win32, and Process Sandboxing. The rest are mitigation bypasses, memory boundary errors, a site isolation issue, and a spoofing flaw. A successful sandbox escape lets malicious web content break out of the browser's isolation layer and reach the host system. The fixes ship in Firefox 156, Firefox 157, and Firefox 157.0.1; Firefox ESR 115.41, 115.42, 140.16, 140.17, 153.3, and 153.4; and Thunderbird 156, 157, 140.16, 140.17, 153.3, and 153.4.

CVE-2026-106016, CVE-2026-92036, CVE-2026-92037, CVE-2026-92061, and CVE-2026-92066 have a CVSS score of 9.8, Critical severity. CVE-2026-100758, CVE-2026-100760, CVE-2026-100762, CVE-2026-100770, CVE-2026-100775, CVE-2026-100778, CVE-2026-100781, CVE-2026-100786, CVE-2026-100787, CVE-2026-100800, CVE-2026-100819, CVE-2026-100828, CVE-2026-100829, CVE-2026-92018, CVE-2026-92032, CVE-2026-92035, CVE-2026-92045, and CVE-2026-92071 have a CVSS score of 9.6, Critical severity. CVE-2026-92059 has a CVSS score of 9.3, Critical severity. CVE-2026-92034, CVE-2026-92038, CVE-2026-92041, CVE-2026-92050, CVE-2026-92051, CVE-2026-92057, CVE-2026-92075, and CVE-2026-92079 have a CVSS score of 9.1, Critical severity. CVE-2026-92048 has a CVSS score of 9.0, Critical severity.

Key Details

Affected Product: Mozilla Firefox
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
CWE Classification: CWE-119

Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.