CVE-2026-16374 is an information disclosure flaw located in the Framework component within Firefox DevTools. It was fixed in Firefox 153 and Firefox ESR 140.13 as part of Mozilla's July 21, 2026 security updates. The Mozilla advisories list this vulnerability with moderate impact and provide references to the underlying bug report. This vulnerability is one among many addressed in these releases, which also include critical and high impact bugs such as sandbox escapes, privilege escalations, and memory safety issues. The vendor advisory explicitly states the fixed versions and does not report any active exploitation in the wild.

The vulnerability allows unauthorized information disclosure within the Firefox DevTools Framework component. While the impact is rated moderate, it could potentially expose sensitive information to an attacker. However, there are no reports of active exploitation in the wild. The fix in Firefox 153 and Firefox ESR 140.13 mitigates this risk.

Users and administrators should update Firefox to version 153 or later, or Firefox ESR to version 140.13 or later, to remediate this vulnerability. The vendor advisory confirms that these versions contain the official fixes. No additional mitigation actions are required beyond applying these updates.