CVE-2026-92074 Mitigation bypass in the Popup Blocker component
Attackers can bypass the Popup Blocker mitigation in Firefox and Thunderbird, allowing unwanted popups or related security restrictions to be circumvented.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92074?
CVE-2026-92074 is a high-severity vulnerability in Mozilla Firefox, published on 15 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Weakness: CWE-693
Which versions are affected by CVE-2026-92074?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2026-92074?
Upgrade to a fixed version.
Is CVE-2026-92074 being exploited?
There is no known exploitation of CVE-2026-92074 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2026-92074, GHSA-q2cq-g7c3-2qgp, UBUNTU-CVE-2026-92074.