Threat database

Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Memory safety bugs present in Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16410 is a critical vulnerability in Mozilla Firefox's JavaScript Engine related to JIT miscompilation. This flaw was fixed in Firefox version 153. The vulnerability allows for potential high impact on confidentiality, integrity, and availability. It is part of a broader set of security fixes released in Firefox 153 and Thunderbird 153. No known exploits in the wild have been reported. Users running Firefox versions prior to 153 are affected and should update to the fixed version.

CVE-2026-16409 is a high-severity vulnerability in Mozilla Firefox involving an invalid pointer in the Security: PSM component. This flaw was addressed and fixed in Firefox version 153. The vulnerability has a CVSS score of 7.5, indicating a significant impact on availability but no direct impact on confidentiality or integrity. Exploits are not known to be in the wild. The issue is part of a broader set of security fixes released in Firefox 153 and Thunderbird 153.

CVE-2026-16408 is a critical integer overflow vulnerability in the Audio/Video Playback component of Mozilla Firefox. This flaw allows an attacker to cause severe impacts including full confidentiality, integrity, and availability compromise. The vulnerability affects Firefox versions prior to 153 and was fixed in Firefox 153. No known exploits are reported in the wild. The issue is part of a broader set of high-impact vulnerabilities addressed in Firefox 153 and Thunderbird 153.

CVE-2026-16407 is a mitigation bypass vulnerability in the DOM: Service Workers component of Mozilla Firefox. This critical security flaw allows bypassing security mitigations and was fixed in Firefox version 153. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The issue affects all Firefox versions prior to 153.

CVE-2026-16406 is a critical mitigation bypass vulnerability in the Networking component of Mozilla Firefox. It affects Firefox versions prior to 153 and was fixed in Firefox 153. The vulnerability has a high CVSS score of 9.1, indicating it allows remote attackers to bypass security mitigations without user interaction or privileges. Mozilla has released an official security advisory confirming the fix in Firefox 153. No known exploits in the wild have been reported at this time.

CVE-2026-16405 is an information disclosure vulnerability in the Networking: WebSockets component of Mozilla Firefox. It allows unauthorized disclosure of information without user interaction or privileges. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. The CVSS v3.1 base score is 7.5 (high severity), indicating a network attack vector with low complexity and no privileges or user interaction required. No known exploits in the wild have been reported. The vendor advisory confirms the fix is available in the stated versions.

CVE-2026-16404 is a spoofing vulnerability affecting Firefox for Android versions prior to 153. The issue allows an attacker to potentially deceive users by presenting false information in the browser interface. This vulnerability has been addressed and fixed in Firefox 153. The CVSS score is 7.4, indicating a high severity level, with the impact primarily on integrity. No known exploits are reported in the wild at this time.

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16402 is an integer overflow vulnerability in the Graphics: ImageLib component of Mozilla Firefox. This vulnerability was fixed in Firefox version 153. It has a critical CVSS score of 9.8, indicating high severity with potential for complete confidentiality, integrity, and availability impact. The vulnerability affects all Firefox versions prior to 153. Mozilla has released an official fix in Firefox 153 to address this issue.

Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16400 is an information disclosure vulnerability in the DOM: Security component of Mozilla Firefox. It was addressed and fixed in Firefox version 153. The vulnerability allows unauthorized disclosure of information but does not impact integrity or availability. This issue is part of a broader set of high-impact security fixes released in Firefox 153. No known exploits in the wild have been reported for this vulnerability.

CVE-2026-16399 is a site isolation vulnerability in the DOM: Navigation component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox version 153. It has a high severity rating with a CVSS score of 7.5, indicating a network exploitable issue with high confidentiality impact but no integrity or availability impact. The vulnerability affects all Firefox versions prior to 153. Mozilla has released an official security advisory confirming the fix in Firefox 153.

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.