CVE-2026-92045: Firefox WebRTC Privilege Escalation Flaw

CVE-2026-92045 Overview

CVE-2026-92045 is a sandbox escape vulnerability in the WebRTC component of Mozilla Firefox and Thunderbird. The flaw stems from incorrect boundary conditions in the Web Real-Time Communication (WebRTC) subsystem. A successful exploit can allow content-process code to break out of the browser sandbox and interact with the host system. Mozilla addressed the issue in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. The vulnerability was disclosed through Mozilla Foundation Security Advisories MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96.

Critical Impact
A sandbox escape in WebRTC undermines a core browser security boundary, exposing user systems to code execution outside the constrained content process.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 153.3
Mozilla Thunderbird versions prior to 156 and 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92045 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92045

Vulnerability Analysis

The vulnerability resides in the WebRTC component, which handles real-time audio, video, and data channels between browser peers. Incorrect boundary condition checks in this component allow memory or state to be manipulated in ways the sandbox model did not anticipate. When triggered from a content process, the flaw enables a sandbox escape, meaning code that should be confined to the renderer can influence resources outside that boundary. Because WebRTC is exposed to any web content that requests media APIs, the attack surface is broad. Mozilla issued coordinated fixes across Firefox and Thunderbird release lines to close the boundary check gap.

Root Cause

The root cause is an incorrect boundary condition in the WebRTC code path. Boundary condition errors typically occur when off-by-one comparisons, unchecked size fields, or edge-case inputs allow data to be read or written outside expected ranges. The security advisories reference the underlying issue tracker entry at Mozilla Bug Report #2054622 for the specific code changes.

Attack Vector

Exploitation requires a victim to load attacker-controlled web content in an affected Firefox build, or to process attacker-controlled remote content in Thunderbird where the WebRTC component is reachable. The malicious content triggers the boundary condition in the WebRTC pipeline to escape the content sandbox. Public technical details about the exploit primitive have not been released. See Mozilla Security Advisory MFSA-2026-90 and Mozilla Security Advisory MFSA-2026-93 for vendor context.

Detection Methods for CVE-2026-92045

Indicators of Compromise

Firefox or Thunderbird processes spawning unexpected child processes or shells following WebRTC session initiation.
Unusual outbound network activity from browser processes to attacker-controlled STUN, TURN, or signaling endpoints.
Crashes in the WebRTC-related modules within Firefox or Thunderbird content processes.

Detection Strategies

Inventory installed versions of Firefox, Firefox ESR, and Thunderbird across managed endpoints and flag builds older than the fixed releases.
Alert on browser processes writing to unusual file system locations or loading unexpected modules after visiting external sites.
Monitor telemetry for browser content process crashes that correlate with WebRTC API usage.

Monitoring Recommendations

Enable endpoint telemetry that captures parent-child process relationships for firefox.exe and thunderbird.exe.
Correlate browser crash events with subsequent process creation or persistence activity on the same host.
Ingest browser and endpoint logs into a centralized data lake to hunt for post-exploitation behavior following sandbox escape attempts.

How to Mitigate CVE-2026-92045

Immediate Actions Required

Upgrade Firefox to version 156 or later on all managed workstations.
Upgrade Firefox ESR deployments to 153.3 or later.
Upgrade Thunderbird to 156 or 153.3 depending on the deployed channel.
Restart browser and mail client processes after patching to ensure the vulnerable code is unloaded.

Patch Information

Mozilla released fixes in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. Additional context is available in Mozilla Security Advisory MFSA-2026-94 and Mozilla Security Advisory MFSA-2026-96.

Workarounds

If immediate patching is not possible, restrict browser use to trusted sites through enterprise policy until updates are deployed.
Disable WebRTC features via enterprise configuration where operational requirements allow.
Block outbound STUN and TURN traffic to untrusted endpoints at the network perimeter as a temporary control.

bash

# Configuration example: enforce Firefox auto-update via enterprise policy (policies.json)
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "DisabledCiphers": {},
    "Preferences": {
      "media.peerconnection.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}