CVE-2026-92072: Firefox Safe Browsing Boundary Vulnerability

CVE-2026-92072 Overview

CVE-2026-92072 is a boundary condition vulnerability in the Safe Browsing component used by Mozilla Firefox and Thunderbird. The flaw stems from incorrect boundary checks in the code path responsible for evaluating Safe Browsing data. Mozilla addressed the issue in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. The vulnerability is documented in Mozilla Foundation Security Advisories MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96.

Critical Impact
Incorrect boundary conditions in the Safe Browsing component can lead to memory safety issues affecting Firefox and Thunderbird users on all supported platforms.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 153.3
Mozilla Thunderbird versions prior to 156 and 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92072 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92072

Vulnerability Analysis

CVE-2026-92072 is classified as a boundary condition error [Boundary Condition Error] in Mozilla's Safe Browsing component. Safe Browsing is the subsystem responsible for checking URLs against lists of known malicious sites and blocking navigation to phishing or malware pages. Incorrect boundary handling in this component can result in out-of-bounds memory access when parsing or comparing Safe Browsing list data.

The vulnerability affects both Firefox and Thunderbird because Thunderbird reuses the Gecko rendering and networking stack. Mozilla did not publish a public exploit or detailed proof-of-concept, and the entry contains no assigned CVSS vector. The Exploit Prediction Scoring System places the probability of exploitation in the lowest range.

Root Cause

The root cause is improper validation of bounds within the Safe Browsing code path. When the component evaluates URL matches or hash prefixes against local list data, it does not correctly constrain memory access to valid buffer ranges. Mozilla addressed the defect as part of a coordinated security release covering multiple memory-safety issues.

Attack Vector

The attack vector is not enumerated in the NVD entry. Safe Browsing evaluates data received from Mozilla's URL classification service and from user navigation, so triggering the boundary condition would likely require the client to process attacker-influenced URLs or malformed list data. Users running unpatched builds of Firefox or Thunderbird are exposed until they upgrade.

No verified public exploit code is available. See the Mozilla Bug Report #2061257 and the Mozilla advisories for technical details.

Detection Methods for CVE-2026-92072

Indicators of Compromise

No public indicators of compromise have been released for CVE-2026-92072.
Unexpected Firefox or Thunderbird process crashes involving the Safe Browsing component may warrant investigation.

Detection Strategies

Inventory installed Firefox, Firefox ESR, and Thunderbird versions across managed endpoints and flag builds older than Firefox 156, Firefox ESR 153.3, Thunderbird 156, or Thunderbird 153.3.
Correlate application crash telemetry with modules related to URL classification and Safe Browsing lookups.
Monitor endpoint browser update channels to confirm the security release has been applied.

Monitoring Recommendations

Enable centralized crash reporting for Firefox and Thunderbird to surface abnormal terminations tied to Gecko networking components.
Track outbound connections from browser processes to unusual destinations following URL evaluation.
Review browser and mail client patch compliance dashboards on a weekly cadence until remediation reaches 100 percent.

How to Mitigate CVE-2026-92072

Immediate Actions Required

Upgrade Mozilla Firefox to version 156 or later on all workstations.
Upgrade Firefox ESR deployments to version 153.3 or later.
Upgrade Thunderbird to version 156 or 153.3, matching the ESR release train in use.
Verify that automatic update mechanisms are enabled for Firefox and Thunderbird on managed endpoints.

Patch Information

Mozilla released fixes as part of the security advisories MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96. The corresponding bug tracker entry is Mozilla Bug Report #2061257. Administrators using enterprise deployment tooling should push the updated MSI or package builds to all endpoints.

Workarounds

No official workaround has been published by Mozilla; patching is the required remediation path.
Where immediate patching is not possible, restrict browsing to trusted destinations through enterprise proxy or DNS filtering.
Disable Safe Browsing lookups only as a last resort, and understand that doing so removes protection against phishing and malware URLs.

bash

# Configuration example: verify installed Firefox version on Linux endpoints
firefox --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion