CVE-2026-92044: Mozilla Firefox HTTP Information Disclosure

CVE-2026-92044 Overview

CVE-2026-92044 is an information disclosure vulnerability in the Networking: HTTP component of Mozilla Firefox and Thunderbird. The flaw allows unauthorized exposure of sensitive data processed by the browser's HTTP networking stack. Mozilla addressed the issue in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. The vulnerability is documented across four Mozilla Foundation Security Advisories: MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96.

Critical Impact
Attackers can leverage the flaw to obtain sensitive information handled by the HTTP networking component, potentially exposing session data or cross-origin content processed by affected Mozilla clients.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 153.3
Mozilla Thunderbird versions prior to 156 and 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92044 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92044

Vulnerability Analysis

The vulnerability resides in the Networking: HTTP component shared across Mozilla's Gecko-based products. This component handles HTTP request construction, response parsing, connection management, and cache interactions. An information disclosure flaw in this layer can expose data that should remain isolated between origins, sessions, or private browsing contexts.

Mozilla has not released full technical exploitation details in the public advisory. The disclosure is coordinated across Firefox, Firefox ESR, and Thunderbird, indicating the defect exists in shared Gecko networking code rather than product-specific logic. Refer to Bugzilla Entry #2051466 once access restrictions are lifted for the complete technical write-up.

Root Cause

The root cause is a defect within the HTTP networking subsystem that permits data intended to remain private to leak to unintended consumers. Common patterns in this class of bug include improper handling of cached responses, mishandled request/response headers, or state confusion between concurrent connections. No CWE identifier has been assigned in the enriched CVE record.

Attack Vector

Exploitation requires the victim to interact with attacker-controlled HTTP content through an affected Firefox or Thunderbird client. Thunderbird exposure typically requires rendering of remote content in email messages. The Mozilla Security Advisory MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96 list this CVE among their fixed issues.

No verified proof-of-concept code is publicly available for CVE-2026-92044. Refer to the linked Mozilla Bugzilla entry for technical exploitation details as they become public.

Detection Methods for CVE-2026-92044

Indicators of Compromise

Firefox or Thunderbird client versions below the fixed releases (Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3) present in inventory data.
Outbound HTTP connections from browser processes to unfamiliar domains immediately following visits to untrusted web content.
Anomalous rendering of remote content within Thunderbird email sessions preceding unusual network egress.

Detection Strategies

Query endpoint inventory sources for installed Mozilla versions and flag any release preceding the patched builds.
Correlate browser process telemetry with outbound network flows to identify unexpected data transmission patterns.
Monitor DNS resolution requests originating from firefox.exe, thunderbird.exe, and their Linux and macOS equivalents for unusual destinations.

Monitoring Recommendations

Ingest browser and mail client version telemetry into the security data lake for continuous version compliance checks.
Enable process-to-network correlation on endpoints to surface unusual HTTP egress from Gecko-based clients.
Alert on privilege or credential material appearing in outbound HTTP request bodies originating from browser processes.

How to Mitigate CVE-2026-92044

Immediate Actions Required

Upgrade Firefox to version 156 or later on all managed endpoints.
Upgrade Firefox ESR deployments to 153.3 or later, particularly in enterprise-managed environments.
Upgrade Thunderbird to version 156 or Thunderbird ESR 153.3 across all user mailboxes.
Validate patched versions across endpoint inventory before closing remediation tickets.

Patch Information

Mozilla released fixes in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. Consult Mozilla Security Advisory MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96 for the complete advisory content and additional CVEs bundled in each release.

Workarounds

Disable automatic loading of remote content in Thunderbird message preferences until patched versions are deployed.
Restrict browsing to trusted sites via web proxy allowlists where full patch rollout is delayed.
Enforce Firefox enterprise policies to disable disk caching in high-sensitivity environments as a temporary defensive measure.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify Thunderbird version
thunderbird --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion