CVE-2026-92077: Firefox SVG Component DOS Vulnerability

CVE-2026-92077 Overview

CVE-2026-92077 is a denial-of-service (DoS) vulnerability in the Scalable Vector Graphics (SVG) component used across Mozilla Firefox and Thunderbird. Mozilla addressed the issue in Firefox 156, Firefox Extended Support Release (ESR) 153.3, Thunderbird 156, and Thunderbird 153.3. Successful exploitation can disrupt the availability of the browser or mail client when a victim renders malicious SVG content. The flaw is tracked in Mozilla Foundation Security Advisories MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96, with underlying analysis in Bugzilla entry #2064601.

Critical Impact
Attackers can trigger a denial-of-service condition in Firefox or Thunderbird by delivering crafted SVG content to a target user.

Affected Products

Mozilla Firefox versions prior to 156
Mozilla Firefox ESR versions prior to 153.3
Mozilla Thunderbird versions prior to 156 and prior to 153.3

Discovery Timeline

2026-09-15 - CVE-2026-92077 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-92077

Vulnerability Analysis

The vulnerability resides in the SVG rendering component shared by Firefox and Thunderbird. Processing a specially crafted SVG document causes the affected application to enter a denial-of-service state. Because Thunderbird uses the same Gecko rendering engine, email messages containing malicious SVG content can also reach vulnerable code paths.

Mozilla's advisories (MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, MFSA-2026-96) confirm the fix ships across both the mainline and ESR release trains. The Exploit Prediction Scoring System (EPSS) currently ranks this issue in the lower percentile for near-term exploitation likelihood, and no public proof-of-concept has been observed.

Root Cause

The root cause is documented in Mozilla Bugzilla entry #2064601, which is referenced by the security advisories. Public technical detail beyond attribution to the SVG component and the denial-of-service impact is limited at time of publication. No Common Weakness Enumeration (CWE) classification has been assigned in the NVD record.

Attack Vector

Exploitation requires the victim to render attacker-controlled SVG content. In Firefox, this occurs when the user visits a malicious or compromised web page. In Thunderbird, exploitation is possible when a crafted message containing SVG content is opened or previewed. No authentication is required, and interaction is limited to viewing the malicious content.

The vulnerability is described by Mozilla in prose form; no verified public exploit code is available. See the Mozilla Security Advisory MFSA-2026-90 and companion advisories for vendor details.

Detection Methods for CVE-2026-92077

Indicators of Compromise

Unexpected Firefox or Thunderbird process crashes, hangs, or high CPU consumption immediately after loading web pages or email messages containing SVG content.
Application crash reports referencing SVG rendering code paths in Gecko.
Repeated automatic restarts of the browser or mail client tied to a single origin or sender.

Detection Strategies

Inventory endpoints running Firefox and Thunderbird and compare installed versions against the fixed releases (156, ESR 153.3, Thunderbird 156, Thunderbird 153.3).
Correlate application crash telemetry with URL and email metadata to identify malicious sources delivering SVG payloads.
Alert on inbound email attachments or embedded content with image/svg+xml MIME type from untrusted senders.

Monitoring Recommendations

Forward browser and mail client crash logs to a central logging platform for trend analysis.
Monitor endpoint performance metrics for repeated process termination of firefox.exe and thunderbird.exe (or equivalent binaries on macOS and Linux).
Track patch compliance for Mozilla products through your endpoint management tooling.

How to Mitigate CVE-2026-92077

Immediate Actions Required

Upgrade Firefox to version 156 or later on all managed endpoints.
Upgrade Firefox ESR deployments to 153.3 or later.
Upgrade Thunderbird to version 156 or Thunderbird ESR 153.3 or later.
Prioritize systems that handle untrusted email or browse external web content.

Patch Information

Mozilla has released fixed builds addressing this issue. Refer to the vendor advisories for build details and download links: MFSA-2026-90, MFSA-2026-93, MFSA-2026-94, and MFSA-2026-96. Underlying bug tracking is available at Mozilla Bug Report #2064601.

Workarounds

Configure Thunderbird to display messages in plain text where operationally feasible to avoid rendering embedded SVG content.
Block or strip image/svg+xml attachments at the mail gateway for high-risk user groups until patches are deployed.
Restrict browsing to trusted sites through web filtering controls while patch rollout is in progress.

bash

# Verify installed Firefox version on Linux/macOS
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# On Windows, query installed version via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Mozilla\Mozilla Firefox" | Select-Object CurrentVersion