CVE-2026-92039 - Vulnerability Details

- Mitigation bypass in the DOM: Notifications component

Description

Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Published: 2026-09-15

Score: 6.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability allows a web page to bypass the browser’s notification permission mechanism, causing desktop notifications to appear as if the user had explicitly granted permission. The flaw is limited to the notification component and does not provide a pathway for arbitrary code execution or direct access to protected data. The description does not indicate exploitation beyond the premature notification display.

Affected Systems

Mozilla Firefox versions older than 156 and the Firefox ESR 153.3 branch, as well as Mozilla Thunderbird releases older than 156 and the Thunderbird ESR 153.3 release, are impacted. The bug was corrected in Firefox 156/ESR 153.3 and Thunderbird 156/ESR 153.3.

Risk and Exploitability

With a CVSS base score of 6.3 this issue is considered medium severity. The EPSS score of less than 1% indicates a very low probability of exploitation. The likely attack vector is a remote web page that invokes the Notification API, and based on the description it is inferred that this could trigger the flaw. The vulnerability is not listed in the CISA KEV catalog, suggesting no large-scale public exploit has been reported.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`153.3`	unaffected	≤ 153.*
`156`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`153.3`	unaffected	≤ 153.*
`156`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[153.3,154.0.0)`	unaffected	generic	—
`[156,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Firefox 156 or newer, or to ESR 153.3 if using an extended support release.
Upgrade Thunderbird to version 156 or newer, or to ESR 153.3 if applicable.
If an update is not immediately possible, disable desktop notifications or set the notification permission to "Block" for all origins via the browser settings.
Optionally, implement a content‑security‑policy that limits the use of the Notification API to trusted origins only.

Generated by OpenCVE AI on September 21, 2026 at 19:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00224.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2001265
https://nvd.nist.gov/vuln/detail/CVE-2026-92039
https://www.cve.org/CVERecord?id=CVE-2026-92039
https://www.mozilla.org/security/advisories/mfsa2026-90/
https://www.mozilla.org/security/advisories/mfsa2026-90/#CVE-2026-92039
https://www.mozilla.org/security/advisories/mfsa2026-93/
https://www.mozilla.org/security/advisories/mfsa2026-94/
https://www.mozilla.org/security/advisories/mfsa2026-94/#CVE-2026-92039
https://www.mozilla.org/security/advisories/mfsa2026-96/

History

Mon, 05 Oct 2026 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::
Vendors & Products		Mozilla thunderbird

Tue, 22 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 21 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-693
Metrics	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`	cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}`

Sun, 20 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-732

Fri, 18 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-358
References		https://nvd.nist.gov/vuln/detail/CVE-2026-92039 https://www.cve.org/CVERecord?id=CVE-2026-92039 https://www.mozilla.org/security/advisories/mfsa2026-90/#CVE-2026-92039 https://www.mozilla.org/security/advisories/mfsa2026-94/#CVE-2026-92039
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` threat_severity `Moderate`

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description	Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.	Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
References		https://www.mozilla.org/security/advisories/mfsa2026-96/

Wed, 16 Sep 2026 05:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-732

Tue, 15 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description	Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.	Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
References		https://www.mozilla.org/security/advisories/mfsa2026-94/

Tue, 15 Sep 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 15 Sep 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Title		Mitigation bypass in the DOM: Notifications component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2001265 https://www.mozilla.org/security/advisories/mfsa2026-90/ https://www.mozilla.org/security/advisories/mfsa2026-93/

Subscriptions

Mozilla Firefox Thunderbird

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-09-15T12:34:00.159Z

Updated: 2026-09-21T17:26:47.004Z

Reserved: 2026-09-15T12:33:59.605Z

Link: CVE-2026-92039

Vulnrichment

Updated: 2026-09-21T17:26:36.357Z

NVD

Status : Analyzed

Published: 2026-09-15T13:16:55.300

Modified: 2026-10-05T17:53:41.050

Link: CVE-2026-92039

Redhat

Severity : Moderate

Publid Date: 2026-09-15T12:34:00Z

Links: CVE-2026-92039 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T19:45:17Z

Weaknesses

CWE-358
Improperly Implemented Security Check for Standard
CWE-693
Protection Mechanism Failure

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object