CVE-2026-16405 is an information disclosure vulnerability affecting the WebSockets networking component in Mozilla Firefox. The flaw could allow an attacker to gain access to sensitive information through the WebSockets interface. Mozilla fixed this vulnerability in Firefox 153 and Firefox ESR 140.13. The CVSS 3.1 vector indicates it is remotely exploitable without privileges or user interaction, with high impact on confidentiality but no impact on integrity or availability. No active exploitation has been observed. The vendor advisory confirms the fix and provides detailed references.

The vulnerability allows unauthorized disclosure of information via the WebSockets component, potentially exposing sensitive data to remote attackers. There is no impact on data integrity or system availability. No known exploits in the wild have been reported, reducing immediate risk but the high CVSS score indicates significant potential impact if exploited.

This vulnerability is fixed in Mozilla Firefox 153 and Firefox ESR 140.13. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.