Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-92033: Firefox for Android can let apps gain higher privileges

CVE-2026-92033 · published 1 month ago

Summary

Older versions of Firefox for Android and its JavaScript component could be tricked into giving a malicious app more access than it should have. This could let the app read or change data it normally couldn't. Updating to the latest Firefox for Android version (156 or newer) resolves the issue.

What to do

Update mozilla firefox_mobile to version 156.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	mozilla	firefox	All versions
Ubuntu:18.04:LTS	canonical	mozjs52	All versions
Ubuntu:18.04:LTS	canonical	mozjs38	All versions
Ubuntu:20.04:LTS	canonical	mozjs68	All versions
Ubuntu:22.04:LTS	canonical	mozjs102	All versions
Ubuntu:22.04:LTS	canonical	mozjs78	All versions
Ubuntu:22.04:LTS	canonical	mozjs91	All versions
Ubuntu:22.04:LTS	canonical	thunderbird	All versions
Ubuntu:24.04:LTS	canonical	mozjs115	All versions
–	mozilla	firefox_mobile	< 156.0 `cpe:2.3:a:mozilla:firefox_mobile::::::android::*`

Original advisory text

Privilege escalation in Firefox for Android

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2047339 Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-90/ Vendor Advisory
https://ubuntu.com/security/CVE-2026-92033 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-92033 Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2026-90/#CVE-2026-92033 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92033... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-92033 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-269Improper Privilege Management

Timeline

Published15 Sep 2026

Updated4 Nov 2026

First seen15 Sep 2026

Sources

CVE-2026-92033 · NVD

CVE-2026-92033 · MITRE

UBUNTU-CVE-2026-92033 · OSV

CVE-2026-92033 · OSV

Track software like this

Free during beta