CVE-2026-92071

CriticalCVSS 9.6/10Last modified Oct 5, 2026

Description

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Oct 5, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-920728.0Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 15CVE-2026-920738.8Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, CVE-2026-920748.8Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and ThundCVE-2026-920759.1Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and ThunderbCVE-2026-920768.8Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, CVE-2026-920776.5Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153CVE-2026-920786.5Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and ThunderbirCVE-2026-920799.1Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and ThundCVE-2026-92088.8Tanium addressed an unauthorized code execution vulnerability in Connect.CVE-2026-920815.9fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via replyCVE-2026-920826.3By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. ToCVE-2026-920849.1The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in a
CVE-2026-92071: Critical severity, CVSS 9.6 | Vulnix