CVE-2026-92017

CVE-2026-92017 is a privilege escalation vulnerability (CWE-269) in the Service Workers component of Firefox's DOM implementation. Exploitation is network-based, requires no attacker privileges, but does require user interaction — meaning a victim must be lured to malicious or compromised web content that abuses service worker handling. A successful attack yields high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8), letting the attacker operate with privileges beyond what ordinary web content should hold. All users of Firefox release builds before 156 and of the ESR branches before 115.41, 140.16, and 153.3 are affected. No public proof-of-concept exists and the flaw is not in the CISA KEV catalog, so no exploitation in the wild has been reported to date.

What to do: Update immediately to Firefox 156, or to the patched ESR release matching your deployment (ESR 115.41, ESR 140.16, or ESR 153.3). Enterprise and org administrators should inventory which ESR branch is in use and push the corresponding build before older branches fall out of support. Verify the running version via the browser's about:support page or update settings, and ensure automatic updates are enabled for end users.