CVE-2026-92034 — Firefox — Fixed in 156; Thunderbird — Fixed in 156

Critical9.1 Published on Sep 15, 2026

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

Fixed versions

Choose the version for your installed product and release branch.

Product	Fixed versions
Firefox	156
Thunderbird	156

CVSS score9.1 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness type (CWE)CWE-346

Vendorsmozilla

Vendors	Product	Versions
mozilla	firefox	< 156.0.0
mozilla	thunderbird	< 156.0

Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.

This product uses the NVD API but is not endorsed or certified by the NVD.