Description
Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

The vulnerability allows a local attacker to elevate privileges within the application through the Developer Tools component. The bug is classified as CWE-269, and could enable the attacker to bypass normal permission constraints and gain higher level access than intended.

Affected Systems

All users running Mozilla Firefox versions before 156 or before ESR 153.3, and users of Thunderbird versions before 156 are affected. Updating to the patched releases eliminates the flaw.

Risk and Exploitability

With a CVSS score of 8.8 this issue is considered high severity. No EPSS score is available, but the lack of an exploit listing in the CISA KEV catalog does not reduce its potential impact. The likely attack vector is a local user or code that can access the DevTools interface; based on the description, it is inferred that an attacker can exploit the bug while the affected application is running.

Generated by OpenCVE AI on September 16, 2026 at 05:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to Firefox 156 or later, Firefox ESR 153.3 or later, or Thunderbird 156 or later.
  • If an update cannot be applied immediately, disable the DevTools interface by setting the about:config preference "devtools.chrome.toolbar.enabled" to false or by using policy to block devtools access.
  • Use additional user‑level or OS‑level controls to restrict local exploits, such as applying least‑privilege operating‑system accounts and disabling unused application features if possible.

Generated by OpenCVE AI on September 16, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
References

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
References

Tue, 15 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Tue, 15 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Title Privilege escalation in the DevTools component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-16T14:24:40.907Z

Reserved: 2026-09-15T12:34:16.112Z

Link: CVE-2026-92055

cve-icon Vulnrichment

Updated: 2026-09-15T13:12:30.772Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T13:16:59.370

Modified: 2026-09-16T19:34:05.910

Link: CVE-2026-92055

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T05:30:13Z

Weaknesses
  • CWE-269

    Improper Privilege Management