CVE-2026-92042 - Vulnerability Details

- Race condition in the DOM: Content Processes component

Description

Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Published: 2026-09-15

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition within Mozilla’s DOM Content Processes component can cause rendering processes to enter an inconsistent state, potentially leading to application crashes. The vulnerability is identified as a race condition (CWE-366 and CWE-362 affecting process stability and user experience).

Affected Systems

The issue impacts both Mozilla Firefox and Mozilla Thunderbird. All releases prior to Firefox 156, Thunderbird 156, and the Firefox ESR 153.3 build are affected. Users running any of those older versions without the respective fixes are susceptible.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is <1%, indicating a very low probability of exploitation. It is not listed in CISA’s KEV catalog. While the description does not specify an explicit attack vector, the race condition could potentially be triggered by malicious content served to the browser or local files, but no public exploit is known.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`153.3`	unaffected	≤ 153.*
`156`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`153.3`	unaffected	≤ 153.*
`156`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[153.3,153.*]`	unaffected	generic	—
`[156,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox to version 156 or later and install the corresponding ESR update 153.3.
Upgrade Mozilla Thunderbird to version 156 or later and install the corresponding ESR update 153.3.
For environments that cannot upgrade immediately, disable content processes by setting the preference 'browser.content_processes' to 0, reducing the race‑condition‑related instability until a patch is applied.

Generated by OpenCVE AI on September 20, 2026 at 17:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00236.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2049342
https://nvd.nist.gov/vuln/detail/CVE-2026-92042
https://www.cve.org/CVERecord?id=CVE-2026-92042
https://www.mozilla.org/security/advisories/mfsa2026-90/
https://www.mozilla.org/security/advisories/mfsa2026-90/#CVE-2026-92042
https://www.mozilla.org/security/advisories/mfsa2026-93/
https://www.mozilla.org/security/advisories/mfsa2026-94/
https://www.mozilla.org/security/advisories/mfsa2026-94/#CVE-2026-92042
https://www.mozilla.org/security/advisories/mfsa2026-96/

History

Mon, 05 Oct 2026 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::
Vendors & Products		Mozilla thunderbird

Sun, 20 Sep 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362
Metrics	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Thu, 17 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Thu, 17 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-366
References		https://nvd.nist.gov/vuln/detail/CVE-2026-92042 https://www.cve.org/CVERecord?id=CVE-2026-92042 https://www.mozilla.org/security/advisories/mfsa2026-90/#CVE-2026-92042 https://www.mozilla.org/security/advisories/mfsa2026-94/#CVE-2026-92042
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` threat_severity `Moderate`

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description	Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.	Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
References		https://www.mozilla.org/security/advisories/mfsa2026-96/

Wed, 16 Sep 2026 06:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Tue, 15 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description	Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.	Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
References		https://www.mozilla.org/security/advisories/mfsa2026-94/

Tue, 15 Sep 2026 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 15 Sep 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Title		Race condition in the DOM: Content Processes component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2049342 https://www.mozilla.org/security/advisories/mfsa2026-90/ https://www.mozilla.org/security/advisories/mfsa2026-93/

Subscriptions

Mozilla Firefox Thunderbird

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-09-15T12:34:03.295Z

Updated: 2026-09-20T00:25:33.037Z

Reserved: 2026-09-15T12:34:02.764Z

Link: CVE-2026-92042

Vulnrichment

Updated: 2026-09-20T00:25:26.380Z

NVD

Status : Analyzed

Published: 2026-09-15T13:16:55.630

Modified: 2026-10-05T17:52:09.030

Link: CVE-2026-92042

Redhat

Severity : Moderate

Publid Date: 2026-09-15T12:34:03Z

Links: CVE-2026-92042 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-20T17:15:17Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-366
Race Condition within a Thread

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object