CVE-2026-92017: Privilege escalation in the DOM: Service Workers component

Published Sep 15, 2026

Updated

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

Affected Software

2 affected components

Mozilla Firefox

Mozilla Firefox ESR

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox (Service Workers) to a version that resolves this vulnerability.
Fixed in 156
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.41
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 140.16
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 153.3

Event History

Sep 15, 2026

CVE Published

via MITRE·12:33 PM

Data Sourced

via MITRE·12:33 PM

Description

Frequently Asked Questions

Which Firefox releases contain the fix?

The fix is included in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

How can I determine whether my deployment has received the fix?

Check the installed Firefox or Firefox ESR version against the listed fixed release for its release branch. Deploy the applicable fixed version if the installation is not yet at that version.