CVE-2026-92035 Sandbox escape due to incorrect boundary conditions in the Graphics component
CriticalCVSS 9.6
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/firefox(Red Hat:enterprise_linux:10.2) | < 140.17.0-1.el10_2 | 140.17.0-1.el10_2 |
| redhat/firefox(Red Hat:enterprise_linux_eus:10.0) | < 140.17.0-1.el10_0 | 140.17.0-1.el10_0 |
| redhat/firefox(Red Hat:rhel_els:7) | < 140.17.0-1.el7_9 | 140.17.0-1.el7_9 |
| redhat/firefox(Red Hat:enterprise_linux:8) | < 140.17.0-1.el8_10 | 140.17.0-1.el8_10 |
| redhat/thunderbird(Red Hat:enterprise_linux:8) | < 140.17.0-1.el8_10 | 140.17.0-1.el8_10 |
| redhat/firefox(Red Hat:rhel_aus:8.4) | < 140.17.0-1.el8_4 | 140.17.0-1.el8_4 |
| redhat/firefox(Red Hat:rhel_eus_long_life:8.4) | < 140.17.0-1.el8_4 | 140.17.0-1.el8_4 |
| redhat/thunderbird(Red Hat:rhel_aus:8.6) | < 140.17.0-1.el8_6 | 140.17.0-1.el8_6 |
| redhat/firefox(Red Hat:rhel_aus:8.6) | < 140.17.0-1.el8_6 | 140.17.0-1.el8_6 |
| redhat/thunderbird(Red Hat:rhel_eus_long_life:8.6) | < 140.17.0-1.el8_6 | 140.17.0-1.el8_6 |
| redhat/firefox(Red Hat:rhel_eus_long_life:8.6) | < 140.17.0-1.el8_6 | 140.17.0-1.el8_6 |
| redhat/thunderbird(Red Hat:rhel_tus:8.8) | < 140.17.0-1.el8_8 | 140.17.0-1.el8_8 |
| redhat/firefox(Red Hat:rhel_tus:8.8) | < 140.17.0-1.el8_8 | 140.17.0-1.el8_8 |
| redhat/thunderbird(Red Hat:rhel_e4s:8.8) | < 140.17.0-1.el8_8 | 140.17.0-1.el8_8 |
| redhat/firefox(Red Hat:rhel_e4s:8.8) | < 140.17.0-1.el8_8 | 140.17.0-1.el8_8 |
| redhat/firefox(Red Hat:enterprise_linux:9) | < 140.17.0-1.el9_8 | 140.17.0-1.el9_8 |
| redhat/firefox(Red Hat:rhel_e4s:9.2) | < 140.17.0-1.el9_2 | 140.17.0-1.el9_2 |
| redhat/firefox(Red Hat:rhel_e4s:9.4) | < 140.17.0-1.el9_4 | 140.17.0-1.el9_4 |
| redhat/firefox(Red Hat:rhel_eus:9.6) | < 140.17.0-1.el9_6 | 140.17.0-1.el9_6 |
| debian/thunderbird(Debian:12) | < 1:140.17.0esr-1~deb12u1 | 1:140.17.0esr-1~deb12u1 |
| debian/thunderbird(Debian:12) | = 1:102.11.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.12.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.12.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.12.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.12.0-1~deb12u1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/thunderbird(Debian:12) | = 1:102.13.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.14.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.14.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.14.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:103.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:104.0~b2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:110.0~b4-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:112.0~b1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:113.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:114.0~b2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0.1-2 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0~b4-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0~b6-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.1.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.1.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.10.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.10.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.10.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.10.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.11.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.11.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.11.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.11.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.12.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.12.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.12.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.12.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.13.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.13.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.13.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.14.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.14.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.15.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.15.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.16.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.16.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.2.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.2.2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.4.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.4.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.4.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.4.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.6.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.6.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.6.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.6.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.7.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.7.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.7.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.7.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.9.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.9.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.9.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.9.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:116.0~b7-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:117.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:120.0~b1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:121.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:122.0~b2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:124.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:125.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:127.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.1.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.1.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.1esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.1esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.11.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.11.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.11.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.12.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.12.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.12.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.13.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.13.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.13.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.14.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.14.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.14.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.14.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.2.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.2.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.2.3esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.3.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.3.2esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.2esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.3esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.3esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.3esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.5.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.5.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.5.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.5.2esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.6.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.6.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.6.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.7.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.7.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.7.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.8.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.8.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.8.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.9.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.9.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.9.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:129.0~b6-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:130.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:132.0~b6-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:135.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:136.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:137.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:138.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.0.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.1.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.1.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.1esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.1esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.1esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.2esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.2esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.2esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.2esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.11.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.11.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.11.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.11.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.12.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.12.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.12.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.12.0esr-1~deb13u1 | No fix listed |
References
- bugzilla.mozilla.org permissions-required
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- Red Hat CVE page vendor-advisory
- RHSA-2026:76764 patch vendor-advisory
- RHSA-2026:92227 patch vendor-advisory
- RHSA-2026:92363 patch vendor-advisory
- RHSA-2026:76850 patch vendor-advisory
- RHSA-2026:90913 patch vendor-advisory
- RHSA-2026:92011 patch vendor-advisory
- RHSA-2026:91634 patch vendor-advisory
- RHSA-2026:92228 patch vendor-advisory
- RHSA-2026:91633 patch vendor-advisory
- RHSA-2026:92327 patch vendor-advisory
- RHSA-2026:76761 patch vendor-advisory
- RHSA-2026:92226 patch vendor-advisory
- RHSA-2026:92012 patch vendor-advisory
- RHSA-2026:92335 patch vendor-advisory
- Red Hat Bugzilla 2533789 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-92035 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory