CVE-2026-92015

CVE-2026-92015 is a privilege escalation flaw (CWE-269, improper privilege management) in the WebExtensions component of Mozilla Firefox, scored CVSS 3.1 at 8.8 (high). The bug allows an attacker to elevate privileges within the browser context, with network access, low attack complexity, no privileges required, but user interaction required — meaning victims are typically lured into an action such as installing or interacting with a crafted extension or page. Successful exploitation can yield high impacts to confidentiality, integrity, and availability within the browser, potentially exposing browsing data, session cookies, or enabling further compromise of the user's context. All users of Firefox releases prior to the fixed versions are affected, including users of the enterprise-focused ESR branches, which hold older vulnerable code bases for extended support periods. No public proof of concept is known and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Update to Firefox 156 or Firefox ESR 115.41, ESR 140.16, or ESR 153.3 depending on your branch, and confirm ESR deployments are pinned to the patched point release since enterprises on stale ESR builds remain exposed. Audit installed extensions and browser policies for anything unusual, and watch for signs of extension-based compromise such as unexpected permission grants or injected content.