Description
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential memory corruption leading to code execution or application crash
Action: Apply patch
AI Analysis

Impact

Use‑after‑free bug in Mozilla Firefox and Thunderbird’s DOM core and HTML processing can corrupt heap memory when arbitrary content is rendered, which may allow an attacker to execute code within the client process or cause it to terminate, impacting confidentiality, integrity, or availability.

Affected Systems

Vulnerable on all Firefox and Thunderbird releases before 156, including ESR 115.41, 140.16, 153.3. The fix is shipped in Firefox 156 and the corresponding ESR releases, and in Thunderbird 156 and the ESR 140.16 and 153.3 releases.

Risk and Exploitability

The CVSS score of 8.8 signals high severity. The EPSS score of less than 1 % suggests a low current likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog. The likely attack vector is delivered through malicious web content that triggers the bug; based on the description, it is inferred that an attacker must supply crafted content that drives the renderer into the vulnerable code path.

Generated by OpenCVE AI on September 20, 2026 at 17:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 156 or later, or to the ESR 115.41, 140.16, or 153.3 releases that contain the fix.
  • Upgrade Mozilla Thunderbird to version 156 or later, or to the ESR 140.16 or 153.3 releases that contain the fix.
  • Enable automatic updates or manually check for updates on all Mozilla applications, and the application after the upgrade.

Generated by OpenCVE AI on September 20, 2026 at 17:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4781-1 firefox-esr security update
Debian DLA Debian DLA DLA-4782-1 thunderbird security update
Debian DSA Debian DSA DSA-6501-1 firefox-esr security update
Debian DSA Debian DSA DSA-6503-1 thunderbird security update
History

Sun, 20 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Thu, 17 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 16 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
References

Wed, 16 Sep 2026 05:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and Thunderbird 140.16. Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.
References

Tue, 15 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and Thunderbird 140.16.
References

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 15 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.
Title Use-after-free in the DOM: Core & HTML component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-20T00:18:32.370Z

Reserved: 2026-09-15T12:33:48.328Z

Link: CVE-2026-92028

cve-icon Vulnrichment

Updated: 2026-09-20T00:18:28.451Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T13:16:53.920

Modified: 2026-09-20T01:16:35.570

Link: CVE-2026-92028

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-15T12:33:48Z

Links: CVE-2026-92028 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T17:30:18Z

Weaknesses