CVE-2026-92020

A privilege escalation vulnerability caused by incorrect boundary conditions exists in the Graphics: WebRender rendering component of Mozilla Firefox, classified as CWE-120 (buffer overflow). An attacker can trigger the flaw by persuading a victim to visit maliciously crafted web content, causing WebRender to read or write outside intended memory boundaries during rendering. Successful exploitation can compromise the affected browser process beyond its normal restrictions, with high impact on confidentiality, integrity, and availability, though user interaction is required. The vulnerability affects all Firefox releases prior to Firefox 156 as well as the ESR branches before 115.41, 140.16, and 153.3. No public proof-of-concept is known, the flaw is not on the CISA KEV list, and there is no indication of exploitation in the wild.

What to do: Update Firefox to version 156 or later immediately; organizations on extended support should move to Firefox ESR 115.41, ESR 140.16, or ESR 153.3 as appropriate for their branch. Verify that automatic updates are enabled and confirm deployed browsers have applied the patched release. Because exploitation requires only that a user visit crafted web content, treat this as a high-priority client-side patch for all managed and BYOD endpoints.