CVE-2026-92055

CVE-2026-92055 is a privilege escalation flaw (CWE-269, improper privilege management) in the DevTools component of Mozilla Firefox, rated high severity with a CVSS 3.1 score of 8.8. The attack vector is network-based with low attack complexity and requires no prior privileges, but it does require user interaction, meaning it is plausibly triggered by persuading a target to interact with attacker-controlled content. If exploited, an attacker gains high impacts to confidentiality, integrity, and availability, effectively breaking out of the intended privilege boundary of the browser component. All users of Firefox versions prior to 156 and Firefox ESR versions prior to 153.3 are affected, with fixes shipped in Firefox 156 and Firefox ESR 153.3. No public proof-of-concept is known, the issue is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Update all Firefox installations to version 156 or later, and Firefox ESR deployments to 153.3 or later, as soon as possible. Ensure automatic updates are enabled for consumer installs, and verify that enterprise-managed ESR fleets have received the patched build. Check browser inventory for any stale or kiosk-style deployments pinned to older builds, since these often miss routine update cycles.