CVE-2026-92015

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=2060235
https://www.mozilla.org/security/advisories/mfsa2026-90/
https://www.mozilla.org/security/advisories/mfsa2026-91/
https://www.mozilla.org/security/advisories/mfsa2026-92/
https://www.mozilla.org/security/advisories/mfsa2026-93/
https://www.mozilla.org/security/advisories/mfsa2026-94/
https://www.mozilla.org/security/advisories/mfsa2026-95/

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-15 13:16

Updated : 2026-09-16 04:18

NVD link : CVE-2026-92015

Mitre link : CVE-2026-92015

CVE.ORG link : CVE-2026-92015

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-92015", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92015", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-15T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "115.41", "versionType": "rpm", "lessThanOrEqual": "115.*"}, {"status": "unaffected", "version": "140.16", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "153.3", "versionType": "rpm", "lessThanOrEqual": "153.*"}, {"status": "unaffected", "version": "156", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "140.16", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "156", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2026-09-15T13:16:51.100", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2060235", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-90/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-91/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-92/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-93/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-94/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-95/", "source": "security@mozilla.org"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16."}], "lastModified": "2026-09-16T04:18:52.610", "sourceIdentifier": "security@mozilla.org"}