Search CVEs, research… / diras.sa

CVE-2026-92050: pre-auth sandbox escape in Mozilla Firefox

Remote attackers can escape Firefox's sandbox and execute high-impact code due to a race condition in the XPConnect component. CVE-2026-92050 scores 9.1 (critical) and requires no authentication or user interaction to exploit, according to the published CVSS vector. The facts provided do not list specific affected Firefox versions or fixed releases; administrators should treat all deployed Firefox installs as potentially at risk until vendor guidance or patches identify affected and fixed versions.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.1CRITICAL
EPSS
0.00437
CWE
CWE-362
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: CVE-2026-92050 allows remote, unauthenticated exploitation without user interaction per the CVSS vector, so prioritize reducing exposure and preparing to apply a vendor update as soon as one is released.

What is CVE-2026-92050?

Remote attackers can escape Firefox's sandbox and execute high-impact code due to a race condition in the XPConnect component. CVE-2026-92050 scores 9.1 (critical) and requires no authentication or user interaction to exploit, according to the published CVSS vector. The facts provided do not list specific affected Firefox versions or fixed releases; administrators should treat all deployed Firefox installs as potentially at risk until vendor guidance or patches identify affected and fixed versions.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Which versions of Mozilla Firefox are affected?

BRANCHAFFECTEDFIXED

Is CVE-2026-92050 being exploited?

There are no public reports of exploitation as of 2026-09-30.

How to fix CVE-2026-92050

  1. Follow Mozilla's official guidance and apply an update as soon as a patch is released.
  2. Reduce network exposure of Firefox endpoints by limiting access and blocking unnecessary outbound connections.
  3. Monitor endpoint and proxy logs for anomalies and signs of sandbox escape or unexpected code execution.
  4. Prepare and test rollback and recovery plans in case an urgent update is required.

Frequently asked questions

Is CVE-2026-92050 being actively exploited?

There are no public reports of active exploitation of CVE-2026-92050 as of 2026-09-30.

Which Firefox versions are affected by CVE-2026-92050?

The provided facts do not specify which Firefox versions are affected; Mozilla's advisories should be checked for an authoritative list.

Is there a patch for CVE-2026-92050?

A patch is not listed in the provided facts; administrators should monitor Mozilla for a security update and apply it when available.

Does CVE-2026-92050 require authentication?

No; the CVSS vector indicates no privileges and no user interaction are required, so exploitation does not need an authenticated user.

References