CVE-2026-92057: Firefox Enterprise Policies Auth Bypass Flaw

CVE-2026-92057 Overview

CVE-2026-92057 is a mitigation bypass vulnerability in the Enterprise Policies component of Mozilla Firefox and Thunderbird. Mozilla addressed the issue in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. The Enterprise Policies component enforces administrator-defined configuration and security controls across managed browser and mail client deployments. A bypass in this component can allow attackers or unprivileged users to circumvent policy-driven security constraints intended to harden endpoint browsing and email workflows.

Critical Impact
An attacker able to bypass Enterprise Policies can neutralize administrator-enforced security controls on managed Firefox and Thunderbird installations, undermining endpoint hardening.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 153.3
Mozilla Thunderbird versions prior to 156 and prior to 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92057 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92057

Vulnerability Analysis

CVE-2026-92057 is classified as a mitigation bypass affecting the Enterprise Policies subsystem in Firefox and Thunderbird. Enterprise Policies allow administrators to enforce settings such as disabling specific features, restricting extensions, controlling network destinations, and blocking risky protocols. A bypass in this component means one or more of these enforced controls can be evaded, returning behavior to an unmanaged or less-restricted state.

Mozilla has not published low-level exploit details for this specific issue. The advisories MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96 describe the fix ships alongside broader Firefox 156, Firefox ESR 153.3, and Thunderbird 156 and 153.3 releases. Refer to the Mozilla Security Advisory MFSA-2026-90 and Bugzilla Report #2065646 for the authoritative technical context.

Root Cause

The root cause is an incomplete enforcement path in the Enterprise Policies component. The condition or code path that should apply an administrator-defined restriction is not evaluated consistently, allowing a specific action to proceed despite an active policy intended to block it.

Attack Vector

Exploitation requires interaction with a Firefox or Thunderbird client governed by Enterprise Policies. A local user, or a remote attacker delivering crafted web content or email, can trigger the affected code path to perform an action that policy should have prevented. No exploit is publicly known and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. See Mozilla Security Advisory MFSA-2026-93 for vendor-supplied detail.

Detection Methods for CVE-2026-92057

Indicators of Compromise

Firefox or Thunderbird processes performing actions that current Enterprise Policy configuration should block, such as loading disallowed extensions or reaching restricted URLs.
Version strings reporting Firefox below 156, Firefox ESR below 153.3, or Thunderbird below 156 or 153.3 on managed endpoints.

Detection Strategies

Inventory installed Mozilla software across the fleet and compare reported versions against the fixed releases.
Audit Enterprise Policy JSON (policies.json) deployment status and cross-check runtime behavior on sample endpoints to confirm policies are enforced.
Correlate browser telemetry with proxy and DNS logs to identify traffic that violates policy scope.

Monitoring Recommendations

Monitor endpoint software inventory feeds for outdated Firefox and Thunderbird versions and alert on drift.
Log and review changes to policies.json, Windows Group Policy Mozilla\Firefox keys, and macOS configuration profiles that manage Firefox and Thunderbird.
Track process launches of firefox.exe and thunderbird.exe with unexpected command-line arguments that may indicate policy circumvention attempts.

How to Mitigate CVE-2026-92057

Immediate Actions Required

Upgrade Firefox to version 156 or later, Firefox ESR to 153.3 or later, and Thunderbird to 156 or 153.3 or later on all managed endpoints.
Validate Enterprise Policy enforcement after upgrade by attempting a policy-restricted action on a test host.
Prioritize patching for endpoints where Enterprise Policies are the primary control preventing risky user behavior.

Patch Information

Mozilla shipped fixes in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. Consult Mozilla Security Advisory MFSA-2026-94 and Mozilla Security Advisory MFSA-2026-96 for release-specific details, and Bugzilla Report #2065646 for the tracking record.

Workarounds

No official workaround is published by Mozilla. Apply the vendor patch as the primary remediation.
Reinforce policy intent with complementary controls at the network layer (proxy, DNS filtering) and endpoint layer (application allowlisting) so that a browser-side bypass does not fully defeat the control.
Restrict local administrative rights so that unprivileged users cannot alter or replace the Firefox or Thunderbird binaries and configuration.

bash

# Configuration example: verify installed Firefox version on Windows endpoints
(Get-ItemProperty "HKLM:\SOFTWARE\Mozilla\Mozilla Firefox").CurrentVersion

# Verify Thunderbird version on Linux
thunderbird --version