CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 153.3
2. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 156
3. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 115.42
4. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 140.17
5. Upgrade

   Upgrade debian/firefox to a version that resolves this vulnerability.

   Fixed in 159.0-1
6. Upgrade

   Upgrade debian/thunderbird to a version that resolves this vulnerability.

   Fixed in 1:153.6.0esr-1~deb12u1Fixed in 1:153.5.1esr-1~deb13u2Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
7. Upgrade

   Upgrade Firefox to a version that resolves this vulnerability.

   Fixed in 156
8. Upgrade

   Upgrade Firefox ESR to a version that resolves this vulnerability.

   Fixed in 153.3
9. Upgrade

   Upgrade Thunderbird to a version that resolves this vulnerability.

   Fixed in 140.17
10. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 156
11. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 153.3
12. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 115.42
13. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 140.17

Event History

Parent advisories

This vulnerability appears in the following advisories.

• MFSA2026-93
• MFSA2026-94
• MFSA2026-98
• MFSA2026-99
• MFSA2026-102
• DSA-6536
• MFSA2026-96
• MFSA2026-90

Peer vulnerabilities

Found alongside the following vulnerabilities.

• CVE-2026-92005
• CVE-2026-92006
• CVE-2026-92007
• CVE-2026-92008
• CVE-2026-92009
• CVE-2026-92010
• CVE-2026-92011
• CVE-2026-92012
• CVE-2026-92013
• CVE-2026-92015
• CVE-2026-92035
• CVE-2026-92016
• CVE-2026-92017
• CVE-2026-92018
• CVE-2026-92019
• CVE-2026-92020
• CVE-2026-92022
• CVE-2026-92023
• CVE-2026-92024
• CVE-2026-92025
• CVE-2026-92026
• CVE-2026-92027
• CVE-2026-92028
• CVE-2026-92029
• CVE-2026-92038
• CVE-2026-92039
• CVE-2026-92041
• CVE-2026-92042
• CVE-2026-92043
• CVE-2026-92044
• CVE-2026-92045
• CVE-2026-92030
• CVE-2026-92046
• CVE-2026-92047
• CVE-2026-92048
• CVE-2026-92049
• CVE-2026-92052
• CVE-2026-92053
• CVE-2026-92054
• CVE-2026-92055
• CVE-2026-92056
• CVE-2026-92057
• CVE-2026-92031
• CVE-2026-92032
• CVE-2026-92058
• CVE-2026-92059
• CVE-2026-92060
• CVE-2026-92062
• CVE-2026-92064
• CVE-2026-92065
• CVE-2026-92067
• CVE-2026-92068
• CVE-2026-92069
• CVE-2026-92070
• CVE-2026-92071
• CVE-2026-92072
• CVE-2026-92073
• CVE-2026-92074
• CVE-2026-92075
• CVE-2026-92076
• CVE-2026-92077
• CVE-2026-92078
• CVE-2026-92079
• CVE-2026-92238
• CVE-2026-92239
• CVE-2026-92240
• CVE-2026-92034
• CVE-2026-92036
• CVE-2026-92037
• CVE-2026-92040
• CVE-2026-92050
• CVE-2026-92051
• CVE-2026-92061
• CVE-2026-92063
• CVE-2026-92066
• CVE-2026-100756
• CVE-2026-100757
• CVE-2026-100758
• CVE-2026-100759
• CVE-2026-100762
• CVE-2026-100766
• CVE-2026-100767
• CVE-2026-100770
• CVE-2026-100771
• CVE-2026-100773
• CVE-2026-100774
• CVE-2026-100775
• CVE-2026-100777
• CVE-2026-100778
• CVE-2026-100779
• CVE-2026-100780
• CVE-2026-100781
• CVE-2026-100782
• CVE-2026-100783
• CVE-2026-100784
• CVE-2026-100785
• CVE-2026-100786
• CVE-2026-100789
• CVE-2026-100790
• CVE-2026-100791
• CVE-2026-100832
• CVE-2026-100797
• CVE-2026-100803
• CVE-2026-100819
• CVE-2026-100821
• CVE-2026-100769
• CVE-2026-100772
• CVE-2026-100776
• CVE-2026-100788
• CVE-2026-100792
• CVE-2026-100794
• CVE-2026-96869
• CVE-2026-100801
• CVE-2026-100807
• CVE-2026-100811
• CVE-2026-100818
• CVE-2026-100820
• CVE-2026-103500
• DLA-4810-1
• CVE-2026-92033

Frequently Asked Questions