CVE-2026-92041 Mitigation bypass in the DOM: Networking component
CriticalCVSS 9.1
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/thunderbird(Debian:14) | < 1:153.3.0esr-1 | 1:153.3.0esr-1 |
| debian/thunderbird(Debian:14) | = 1:128.13.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:128.14.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:128.14.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:128.14.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:128.14.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:129.0~b6-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:130.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:132.0~b6-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:135.0-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:136.0-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:137.0-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:138.0-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.0.1esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.1.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.1.1esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.1esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.1esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.1esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.1esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.2esr-1 | No fix listed |
Show 83 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/thunderbird(Debian:14) | = 1:140.10.2esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.2esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.10.2esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.11.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.11.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.11.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.11.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.12.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.12.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.12.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.12.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.13.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.13.0esr-2 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.13.0esr-2~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.13.0esr-2~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.13.0esr-2~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.14.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.14.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.14.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.14.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.15.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.15.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.16.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.16.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.17.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.17.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.2.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.3.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.3.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.3.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.3.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.3.1esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.4.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.4.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.4.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.4.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.5.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.5.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.5.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.5.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.6.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.6.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.6.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.6.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.7.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.7.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.7.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.7.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.7.1esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.7.1esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.7.1esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.7.1esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.8.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.8.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.8.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.8.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.9.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.9.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.9.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.9.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.9.1esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.9.1esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.9.1esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:140.9.1esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:143.0.1-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:144.0.1-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:148.0.1-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:149.0.2-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:152.0-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:153.0.1esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:153.0.3esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:153.1.0esr-1 | No fix listed |
| debian/thunderbird(Debian:14) | = 1:153.2.0esr-1 | No fix listed |
| ubuntu/mozjs102(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/mozjs78(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/mozjs91(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/thunderbird(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/mozjs102(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/mozjs115(Ubuntu:24.04) | All versions | No fix listed |
| mozilla Firefox | < 153.3.0 | 153.3.0 |
| mozilla Firefox | >= 154.0.0, < 156.0.0 | 156.0.0 |
| mozilla Thunderbird | < 153.3.0 | 153.3.0 |
| mozilla Thunderbird | >= 154.0, < 156.0 | 156.0 |
References
- bugzilla.mozilla.org permissions-required
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2533752 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-92041 vendor-advisory
- Ubuntu CVE tracker vendor-advisory