CVE-2026-92074: Firefox Popup Blocker Auth Bypass Flaw

CVE-2026-92074 Overview

CVE-2026-92074 is a mitigation bypass vulnerability in the Popup Blocker component of Mozilla Firefox and Thunderbird. The flaw allows web content to circumvent the browser's popup suppression logic, enabling unwanted windows to open without user interaction. Mozilla addressed the issue in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Critical Impact
Attackers can defeat popup-blocking protections to deliver phishing surfaces, social-engineering prompts, or malvertising through crafted web content.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 153.3
Mozilla Thunderbird versions prior to 156 and 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92074 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92074

Vulnerability Analysis

The vulnerability is classified as a mitigation bypass affecting the Popup Blocker component shared across Mozilla's Gecko-based products. The Popup Blocker enforces user-gesture and rate-limit heuristics to decide whether window.open() and related APIs may spawn a new window. A flaw in that decision path lets crafted web content produce popups the browser should have suppressed.

Because the issue is a bypass of an existing mitigation rather than a memory-safety flaw, exploitation does not lead directly to code execution. The impact is scoped to unwanted UI presentation, which attackers commonly leverage for phishing pages, tech-support scam dialogs, and forced navigation to attacker-controlled content.

Mozilla tracks the underlying defect in Mozilla Bug Report #2063539 and describes the fix in advisories MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96.

Root Cause

The root cause is incorrect enforcement of popup-suppression checks inside the Popup Blocker component. Specific technical details have not been published by Mozilla at the time of writing. Refer to the linked advisories and bug report for the definitive analysis once made public.

Attack Vector

Exploitation requires a victim to visit or render attacker-controlled web content in an affected Firefox or Thunderbird build. No authentication is required, and the attack is delivered through standard web rendering. Because Thunderbird renders remote HTML content in some workflows, message-driven exploitation paths are also plausible.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The EPSS model currently places this issue in the low-probability range for near-term exploitation.

Detection Methods for CVE-2026-92074

Indicators of Compromise

Firefox or Thunderbird processes spawning unexpected browser windows tied to unfamiliar domains.
Endpoint telemetry showing outbound connections to typosquatted or newly registered domains immediately after rendering third-party content.
User reports of phishing pages, fake update prompts, or forced redirects that bypass popup blocking.

Detection Strategies

Inventory Firefox and Thunderbird versions across the fleet and flag any build below Firefox 156, Firefox ESR 153.3, or Thunderbird 156 / 153.3.
Correlate browser child-process creation events with navigation telemetry to identify suspicious window-spawn patterns.
Monitor web proxy logs for anomalous popup-driven redirects to phishing or malvertising infrastructure.

Monitoring Recommendations

Track browser version drift continuously and alert when unpatched instances persist beyond the patch SLA.
Ingest browser and proxy logs into a centralized analytics pipeline to hunt for popup-driven credential-harvesting flows.
Review user-reported phishing incidents for a browser-version pivot that identifies unpatched hosts.

How to Mitigate CVE-2026-92074

Immediate Actions Required

Upgrade Firefox to version 156 or later on all managed endpoints.
Upgrade Firefox ESR deployments to 153.3 or later.
Upgrade Thunderbird to 156 or the 153.3 ESR release, whichever matches your deployment channel.
Verify enterprise policy configurations enforce automatic browser updates.

Patch Information

Mozilla resolved the vulnerability in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. Patch details are documented in MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96. Administrators managing enterprise deployments should apply the fixed builds through their standard channel (Mozilla Enterprise MSI, ESR repositories, or OS package managers).

Workarounds

Restrict rendering of untrusted web content by enforcing strict site categorization at the web proxy.
Configure Thunderbird to block remote content in messages by default to reduce message-driven exposure.
Deploy user awareness reminders about phishing prompts appearing outside of expected workflows until patching completes.

bash

# Verify Firefox version on Linux endpoints
firefox --version

# Verify Thunderbird version on Linux endpoints
thunderbird --version

# Windows: query installed Firefox build via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion