Mozilla
Security Vulnerabilities fixed in Firefox 156
MFSA2026-90 Sep 15, 2026 Source: Vendor
Imported from Mozilla security advisory MFSA2026-90. Draft.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-90/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
73 lines
Showing 51–73 of 73 , page 2 of 2
CVE-2026-92032
BR2026-0000-042761
unclaimed
Moderate: Sandbox escape due to invalid pointer in the Graphics component
Credited as Mozilla
CVE-2026-92058
BR2026-0000-042762
unclaimed
Moderate: Use-after-free in the Graphics component
Credited as Mozilla
CVE-2026-92059
BR2026-0000-042763
unclaimed
Moderate: Incorrect boundary conditions in the DOM: Editor component
Credited as Mozilla
CVE-2026-92060
BR2026-0000-042764
unclaimed
Low: Use-after-free in the Internationalization component
Credited as Mozilla
CVE-2026-92061
BR2026-0000-042765
unclaimed
Low: Incorrect boundary conditions in the Security: Process Sandboxing component
Credited as Mozilla
CVE-2026-92062
BR2026-0000-042766
unclaimed
Low: Privilege escalation in the Session Restore component
Credited as Mozilla
CVE-2026-92063
BR2026-0000-042767
unclaimed
Low: Denial-of-service in the Audio/Video component
Credited as He Huang
CVE-2026-92064
BR2026-0000-042768
unclaimed
Low: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
Credited as Mozilla
CVE-2026-92065
BR2026-0000-042769
unclaimed
Low: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
Credited as Mozilla
CVE-2026-92066
BR2026-0000-042770
unclaimed
Low: Sandbox escape in the Profile Backup component
Credited as Mozilla
CVE-2026-92067
BR2026-0000-042771
unclaimed
Low: Use-after-free in the Widget: Gtk component
Credited as Mozilla
CVE-2026-92068
BR2026-0000-042772
unclaimed
Low: Site isolation issue in the Reader Mode component
Credited as Mozilla
CVE-2026-92069
BR2026-0000-042773
unclaimed
Low: Spoofing issue in the DOM: Navigation component
Credited as Mozilla
CVE-2026-92070
BR2026-0000-042774
unclaimed
Low: Information disclosure in the Networking component
Credited as Mohamed Mbarek
CVE-2026-92071
BR2026-0000-042775
unclaimed
Low: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
Credited as Mozilla
CVE-2026-92072
BR2026-0000-042776
unclaimed
Low: Incorrect boundary conditions in the Safe Browsing component
Credited as Mozilla
CVE-2026-92073
BR2026-0000-042777
unclaimed
Low: Privilege escalation in the Enterprise Policies component
Credited as Tyler Maclachlan
CVE-2026-92074
BR2026-0000-042778
unclaimed
Low: Mitigation bypass in the Popup Blocker component
Credited as Finn Westendorf
CVE-2026-92075
BR2026-0000-042779
unclaimed
Low: Mitigation bypass in the Networking component
Credited as Takeshi Kaneko
CVE-2026-92076
BR2026-0000-042780
unclaimed
Low: Incorrect boundary conditions in the Networking component
Credited as Mozilla
CVE-2026-92077
BR2026-0000-042781
unclaimed
Low: Denial-of-service in the SVG component
Credited as sak
CVE-2026-92078
BR2026-0000-042782
unclaimed
Low: Denial-of-service in the Security component
Credited as Dominik Bay
CVE-2026-92079
BR2026-0000-042783
unclaimed
Low: Mitigation bypass in the Widget: Win32 component
Credited as barbarossa404