CVE-2026-92059

Awaiting Analysis Awaiting Analysis - Queue

DOM Parser Boundary Condition Flaw in Firefox

Publication date: 2026-09-15

Last updated on: 2026-10-05

Assigner: Mozilla Corporation

Description

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-10-05

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-92059

EUVD

EUVD-2026-78522

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	From 154.0 (inc) to 156.0 (exc)
mozilla	firefox	to 153.3.0 (exc)
mozilla	firefox	From 154.0.0 (inc) to 156.0.0 (exc)
mozilla	thunderbird	to 153.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect boundary conditions in the DOM Editor component of Firefox. It was patched in Firefox 156 and Firefox ESR 153.3.

Detection Guidance

This vulnerability is specific to the DOM: Editor component in Firefox, Firefox ESR, and Thunderbird. Detection requires checking the installed versions of these applications. If you are running Firefox versions before 156, Firefox ESR before 153.3, or Thunderbird before 156, your system is vulnerable.

Impact Analysis

An attacker could exploit this flaw to cause unexpected behavior or crashes in the DOM Editor component, potentially leading to memory corruption or arbitrary code execution.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The description only mentions incorrect boundary conditions in the DOM Editor component without detailing potential impacts on data protection or privacy regulations.

Mitigation Strategies

Update Firefox to version 156 or later and Firefox ESR to version 153.3 or later to address the vulnerability in the DOM Editor component.

Hi! I’m here to help you understand CVE-2026-92059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70