CVE-2026-92018 Sandbox escape in the DOM: Core & HTML component

Critical 9.6 Published 15 Sep 2026 Updated 20 Sep 2026

An attacker can escape the browser sandbox to execute arbitrary code on the host system via a flaw in the DOM core component.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-92018?

CVE-2026-92018 is a critical vulnerability in Mozilla Firefox, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Weakness: CWE-693

Which versions are affected by CVE-2026-92018?

It affects 2 products.

Products include Mozilla Firefox, Mozilla Thunderbird.

How do I fix CVE-2026-92018?

Upgrade to a fixed version.

Is CVE-2026-92018 being exploited?

There is no known exploitation of CVE-2026-92018 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-92018, GHSA-f8x3-g25f-rfqc, UBUNTU-CVE-2026-92018.