CVE-2026-92054

CVE-2026-92054 is a privilege escalation vulnerability in the Memory component of Mozilla Firefox, classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer), indicating a memory corruption flaw. Exploitation requires user interaction over the network, meaning a victim typically must visit attacker-controlled or compromised web content for the bug to trigger. A successful exploit gives the attacker high impact on confidentiality, integrity, and availability — consistent with escaping normal browser content-process restrictions and running code with elevated privileges inside the browser. The flaw affects Mozilla Firefox versions prior to 156 and Firefox ESR versions prior to 153.3, which are the releases containing the fix. There is no known public proof of concept and the issue is not on the CISA Known Exploited Vulnerabilities catalog, so no in-the-wild exploitation has been reported to date.

What to do: Update all Firefox desktop installations to Firefox 156 and all Firefox ESR deployments to Firefox ESR 153.3 as soon as possible; enterprises should verify their ESR channel and push the patched build via their management tools. Users can confirm their version via the browser's Help > About dialog and enable automatic updates. Monitor Mozilla's security advisories for any follow-up details on this issue.