CVE-2026-16375 describes a site isolation issue within the Networking: HTTP component of Mozilla Firefox. Site isolation is a security feature designed to separate different web origins into distinct processes to prevent cross-site data leaks and attacks. The vulnerability could undermine this isolation, potentially allowing unauthorized access or data leakage between sites. Mozilla fixed this vulnerability in Firefox 153 and Firefox ESR 140.13. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory lists this vulnerability among multiple critical and moderate impact issues resolved in these releases.

The vulnerability impacts the confidentiality, integrity, and availability of Firefox users by compromising site isolation in the Networking: HTTP component. This could allow an attacker to bypass security boundaries between web origins, potentially leading to unauthorized data access or manipulation. However, there are no reports of active exploitation in the wild at this time.

An official fix is available and has been released by Mozilla. Users and administrators should update to Firefox version 153 or later, or Firefox ESR 140.13 or later, to remediate this vulnerability. No additional mitigation actions are specified or required beyond applying the official update.