CVE-2026-92028: Use-after-free in the DOM: Core & HTML component

Q: Which Firefox releases contain the fix?

The issue was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

Published Sep 15, 2026

Updated

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

Affected Software

2 affected components

Mozilla Firefox<156

Firefox ESR>=115.41<=115.41, >=140.16<=140.16, >=153.3<=153.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 156
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.41
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 140.16
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 153.3

Event History

Sep 15, 2026

CVE Published

via MITRE·12:33 PM

Data Sourced

via MITRE·12:33 PM

Description

Frequently Asked Questions

Which Firefox releases contain the fix?