CVE-2026-92030

Awaiting Analysis Awaiting Analysis - Queue

DOM Clobbering Mitigation Bypass in Firefox

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: Mozilla Corporation

Description

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-92030

EUVD

EUVD-2026-78493

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	156
mozilla	firefox_esr	140.16
mozilla	firefox_esr	153.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability is a mitigation bypass in Firefox's DOM Copy & Paste and Drag & Drop component. It allows attackers to bypass security measures in these features, potentially enabling unauthorized data access or manipulation.

Detection Guidance

This vulnerability is specific to Firefox versions before 156, Firefox ESR before 140.16, and Firefox ESR before 153.3. To detect it, check your installed Firefox version using commands like 'firefox --version' or 'about:support' in Firefox. Compare the version against the patched releases.

Impact Analysis

If exploited, this vulnerability could allow attackers to bypass security restrictions when copying, pasting, or dragging and dropping data in Firefox. This might lead to unauthorized data exfiltration or injection of malicious content.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. Without additional context on data exposure or processing implications, its effect on compliance cannot be determined.

Mitigation Strategies

Update Firefox to version 156 or later, Firefox ESR to version 140.16 or later, or Firefox ESR to version 153.3 or later to address the DOM Copy & Paste and Drag & Drop component vulnerability.

Hi! I’m here to help you understand CVE-2026-92030. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70