CVE-2026-92071 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
CriticalCVSS 9.6
EPSS 0.24%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/mozjs102(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/mozjs78(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/mozjs91(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/thunderbird(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/mozjs102(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/mozjs115(Ubuntu:24.04) | All versions | No fix listed |
| mozilla Firefox | < 153.3.0 | 153.3.0 |
| mozilla Firefox | >= 154.0.0, < 156.0.0 | 156.0.0 |
| mozilla Thunderbird | < 153.3.0 | 153.3.0 |
| mozilla Thunderbird | >= 154.0, < 156.0 | 156.0 |
References
- bugzilla.mozilla.org permissions-required
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2533733 issue-tracking
- www.cve.org
- nvd.nist.gov
- Ubuntu CVE tracker vendor-advisory
- Debian Security Tracker CVE-2026-92071 vendor-advisory