Description
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Mitigation bypass
Action: Patch
AI Analysis

Impact

Based on the description, it is inferred that a malicious web page could bypass the browser’s popup blocker, letting normally suppressed popups appear. This is a CWE‑807 flaw, and also a CWE‑693 flaw, indicating improper control of a critical security feature. The vulnerability does not grant direct code execution or data access. The CVSS score of 8.8 indicates a high severity vulnerability.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. Versions earlier than Firefox 156 or Firefox ESR 153.3, and earlier than Thunderbird 156 or Thunderbird ESR 153.3 remain vulnerable.

Risk and Exploitability

The CVSS score is 8.8, indicating high risk to confidentiality, integrity, and availability. The EPSS score of <1% implies a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the bypass can be triggered by visiting a malicious site and requires no special privileges.

Generated by OpenCVE AI on September 22, 2026 at 18:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 156 or later, or to Firefox ESR 153.3 or newer.
  • Upgrade Thunderbird to version 156 or newer.
  • Ensure the default popup blocker is enabled in the browser settings to prevent unintended popups.

Generated by OpenCVE AI on September 22, 2026 at 18:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Tue, 22 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-693
Metrics cvssV3_1

{'score': 3.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Fri, 18 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-807
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N'}

threat_severity

Low

Thu, 17 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264

Wed, 16 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
References

Wed, 16 Sep 2026 05:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
References

Tue, 15 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 15 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Title Mitigation bypass in the Popup Blocker component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-22T16:08:36.861Z

Reserved: 2026-09-15T12:34:35.643Z

Link: CVE-2026-92074

cve-icon Vulnrichment

Updated: 2026-09-22T15:54:43.279Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T13:17:02.877

Modified: 2026-10-05T19:32:26.820

Link: CVE-2026-92074

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-15T12:34:36Z

Links: CVE-2026-92074 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T19:00:13Z

Weaknesses
  • CWE-693

    Protection Mechanism Failure

  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision