CVE-2026-92019: Firefox Remote Settings Auth Bypass

CVE-2026-92019 Overview

CVE-2026-92019 is a mitigation bypass vulnerability in the Remote Settings Client component of Mozilla Firefox and Thunderbird. The Remote Settings Client synchronizes security-critical data such as certificate revocations, blocklists, and configuration updates from Mozilla infrastructure to client applications. A weakness in this component allows an attacker to circumvent a security mitigation that the client is expected to enforce. Mozilla addressed the flaw in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Critical Impact
An attacker who successfully bypasses the Remote Settings Client mitigation may undermine trust decisions the browser relies on for certificate validation, add-on blocklists, and other safety-critical policies.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 115.41, 140.16, and 153.3
Mozilla Thunderbird versions prior to 156, 140.16, and 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92019 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92019

Vulnerability Analysis

The Remote Settings Client is a Firefox and Thunderbird subsystem that pulls policy and configuration data from Mozilla-hosted services. It distributes items such as the OneCRL certificate revocation list, add-on blocklists, tracking protection lists, and various feature-gating settings. The client validates signed collections before applying them, and it enforces safeguards against stale or replayed data.

CVE-2026-92019 is classified by Mozilla as a mitigation bypass in this component. The flaw allows an attacker positioned to influence the update flow to sidestep one of the protective checks the client applies to incoming settings. The consequence is that the client may accept, apply, or fail to apply a Remote Settings collection in a state the mitigation was designed to prevent.

Mozilla did not publish exploitation-in-the-wild indicators for this issue, and the EPSS data reflects a low near-term exploitation forecast. The vulnerability was fixed across the current Firefox release channel, all supported ESR branches, and matching Thunderbird builds, indicating the affected code path is present across long-lived release trains.

Root Cause

The root cause is a defect in a defensive check within the Remote Settings Client. The mitigation was intended to reject or constrain updates under specific conditions, but the enforcement path can be circumvented. Mozilla has not published implementation-level details. Refer to the Mozilla Bug Report #2065636 and advisories MFSA-2026-90 through MFSA-2026-96 for authoritative technical detail.

Attack Vector

The attack vector is not documented in the public CVE record. Bypasses in the Remote Settings Client generally require an attacker to influence or intercept the data delivered to the client, or to leverage a compromised or malicious signed payload accepted by the weakened check. Users on unpatched builds remain exposed until the browser or mail client is updated.

No public proof-of-concept code is available for CVE-2026-92019. See the linked Mozilla advisories for authoritative details.

Detection Methods for CVE-2026-92019

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-92019.
Unexpected changes to Firefox or Thunderbird Remote Settings state files under the user profile directory, such as settings/ databases inside the profile, warrant review.
Anomalous outbound traffic from Firefox or Thunderbird processes to hosts other than firefox.settings.services.mozilla.com may indicate tampering with the update path.

Detection Strategies

Inventory installed Firefox and Thunderbird versions across the fleet and flag any build older than the fixed versions listed by Mozilla.
Monitor endpoint telemetry for browser or mail-client processes making network connections that deviate from expected Mozilla Remote Settings endpoints.
Track failed or unexpected signature validation events written to browser logs where verbose logging is enabled.

Monitoring Recommendations

Enable centralized collection of browser version telemetry from managed endpoints and correlate against the Mozilla fixed-version list.
Alert on Firefox or Thunderbird processes writing to Remote Settings storage outside normal update windows.
Watch for TLS interception or proxy misconfigurations that could allow an attacker to influence Mozilla update traffic.

How to Mitigate CVE-2026-92019

Immediate Actions Required

Update Firefox to version 156 or later on all managed endpoints.
Update Firefox ESR to 115.41, 140.16, or 153.3 depending on the deployed branch.
Update Thunderbird to 156, 140.16, or 153.3 depending on the deployed branch.
Prioritize systems where Firefox or Thunderbird is used with elevated privileges or on jump hosts.

Patch Information

Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. Full details are published in MFSA-2026-90, MFSA-2026-91, MFSA-2026-92, MFSA-2026-93, MFSA-2026-94, MFSA-2026-95, and MFSA-2026-96.

Workarounds

No vendor-supplied workaround has been published. Applying the vendor patch is the supported remediation.
Enforce automatic updates for Firefox and Thunderbird through enterprise policies so patched builds reach users without manual intervention.
Restrict browser and mail-client egress to legitimate Mozilla update infrastructure using an allowlist on the network perimeter.

bash

# Enterprise policy example: enforce automatic updates for Firefox on Linux
# /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "ManualAppUpdateOnly": false
  }
}