CVE-2026-92017: Firefox Service Workers Privilege Escalation

CVE-2026-92017 Overview

CVE-2026-92017 is a privilege escalation vulnerability in the DOM: Service Workers component of Mozilla Firefox and Thunderbird. The flaw allows an attacker to elevate privileges within the browser process by abusing Service Worker handling. Exploitation requires user interaction, typically visiting a malicious web page, and can be triggered over the network. Mozilla addressed the issue across multiple product lines in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability is classified under [CWE-269] Improper Privilege Management.

Critical Impact
Successful exploitation enables an attacker to gain elevated privileges inside the affected browser or mail client, compromising confidentiality, integrity, and availability of the user's session.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 115.41, 140.16, and 153.3
Mozilla Thunderbird versions prior to 156, 140.16, and 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92017 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92017

Vulnerability Analysis

The vulnerability resides in the Service Workers implementation within the browser's DOM subsystem. Service Workers act as programmable network proxies that run in a background context, independent of the originating web page. A privilege management flaw in this component allows a malicious origin to perform actions outside the boundaries normally enforced by the browser's security model. Because Service Workers persist beyond the lifetime of a single page load, the impact can extend across subsequent browsing sessions until the worker is unregistered or the browser is patched.

Root Cause

The defect is categorized as improper privilege management [CWE-269] in the DOM Service Workers component. Mozilla's advisories indicate that the component did not correctly constrain the privileges of Service Worker contexts, permitting operations that should have been restricted to higher-privileged code paths. Full technical details are tracked in Mozilla Bug Report #2061777.

Attack Vector

An attacker hosts a crafted web page that registers or interacts with a Service Worker to trigger the flaw. The victim must visit the page or open crafted content in Thunderbird for exploitation to succeed. Once the Service Worker executes with elevated privileges, the attacker can influence subsequent requests, cached responses, and browser-mediated operations tied to the victim's session. See the Mozilla Security Advisory MFSA-2026-90 family for advisory details.

No verified public proof-of-concept code is available at this time. Refer to the Mozilla bug report and advisories for technical specifics.

Detection Methods for CVE-2026-92017

Indicators of Compromise

Unexpected Service Worker registrations for domains the user did not intentionally visit, visible under about:serviceworkers in Firefox.
Persistent background network requests originating from a browser process after tabs referencing the origin have been closed.
Browser or Thunderbird versions running below the fixed releases in enterprise inventory data.

Detection Strategies

Inventory installed Firefox and Thunderbird versions across managed endpoints and flag any running below Firefox 156, Firefox ESR 115.41/140.16/153.3, or Thunderbird 156/140.16/153.3.
Monitor endpoint telemetry for browser child processes performing anomalous file, registry, or network activity following visits to untrusted origins.
Correlate proxy or DNS logs with browser telemetry to identify beaconing patterns consistent with malicious Service Worker activity.

Monitoring Recommendations

Enable EDR process and network telemetry for firefox.exe, firefox-bin, and thunderbird processes and their child content processes.
Alert on browser processes spawning unexpected child processes or writing to sensitive directories.
Track outbound HTTP/HTTPS requests initiated by browser processes when no interactive tab is present.

How to Mitigate CVE-2026-92017

Immediate Actions Required

Upgrade Firefox to version 156 or the appropriate ESR release: 115.41, 140.16, or 153.3.
Upgrade Thunderbird to version 156, 140.16, or 153.3 as applicable to the deployed channel.
Restart affected applications after patching to ensure updated Service Worker enforcement is active.
Instruct users to avoid untrusted links until managed endpoints are updated.

Patch Information

Mozilla released fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. Details are available in the Mozilla Security Advisory MFSA-2026-90, MFSA-2026-91, MFSA-2026-92, MFSA-2026-93, MFSA-2026-94, MFSA-2026-95, and MFSA-2026-96.

Workarounds

Deploy enterprise policies that restrict browsing to trusted origins until updates are installed.
Clear existing Service Worker registrations via about:serviceworkers on managed endpoints as an interim containment step.
Use group policy or configuration management to disable Service Workers in high-risk environments where feasible, understanding it may break legitimate web applications.

bash

# Example: enforce Firefox auto-update via enterprise policy (policies.json)
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "BlockAboutConfig": false
  }
}