High severity8.8NVD Advisory· Published Sep 15, 2026· Updated Oct 5, 2026

CVE-2026-92067

Description

Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Mozilla Corporation/Firefox2 versions
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <153.3.0
- (no CPE)range: >=156
Mozilla Corporation/Thunderbird2 versions
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <153.3.0
- (no CPE)range: >=156
osv-coords4 versions
pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed
< 153.3.0-160000.1.1+ 3 more
- (no CPE)range: < 153.3.0-160000.1.1
- (no CPE)range: < 153.4.0-1.1
- (no CPE)range: < 156.0-1.1
- (no CPE)range: < 153.3.0-1.1
Mozilla Corporation/Firefox Esrllm-fuzzy
Range: >=153.3