This vulnerability in Mozilla Firefox involves the DOM Copy & Paste and Drag & Drop component, allowing an attacker to gain unauthorized access to information (confidentiality impact) without requiring privileges or user interaction. It is identified as CVE-2026-16378 and was fixed in Firefox 153. The CVSS 3.1 vector indicates a network attack vector with low complexity and no required privileges or user interaction. The vendor advisory confirms the fix in Firefox 153 and categorizes the impact as moderate for this specific issue, within a broader set of vulnerabilities addressed in that release.

The vulnerability allows an attacker to access sensitive information through the DOM Copy & Paste and Drag & Drop component, impacting confidentiality. There is no impact on integrity or availability. The CVSS score of 7.5 reflects a high severity due to the ease of exploitation and the potential confidentiality breach. No known exploits have been reported in the wild, reducing immediate risk but the vulnerability remains critical to patch.

Mozilla has released an official fix for this vulnerability in Firefox version 153. Users and administrators should update affected Firefox installations to version 153 or later to remediate this issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is mitigated by other means.