Threat database

CVE-2026-16394 is a mitigation bypass vulnerability in the DOM security component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox version 153. It has a high CVSS score of 9.1, indicating critical severity with high impact on confidentiality and integrity. The issue affects all Firefox versions prior to 153. The vendor advisory confirms the fix is included in Firefox 153. There are no known exploits in the wild at this time.

CVE-2026-16359 is a critical vulnerability in Mozilla Firefox related to incorrect boundary conditions in the Audio/Video GMP component. This flaw could lead to high impact consequences including potential arbitrary code execution due to memory corruption. The vulnerability affects Firefox versions prior to 153 and Firefox ESR versions prior to 115.38 and 140.13. Mozilla has fixed this issue in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. No known exploits in the wild have been reported at this time.

CVE-2026-16393 is a critical vulnerability in Mozilla Firefox affecting the Graphics: WebGPU component due to incorrect boundary conditions. This flaw was fixed in Firefox version 153. The vulnerability has a high CVSS score of 9.1, indicating it can be exploited remotely without user interaction and can cause high impact on confidentiality and availability. No known exploits in the wild have been reported. The vendor advisory confirms the issue and the availability of a fix in Firefox 153.

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16391 is an information disclosure vulnerability in the Storage: IndexedDB component of Mozilla Firefox. This flaw allows unauthorized access to sensitive information. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. It has a high severity rating with a CVSS score of 7.5. There are no known exploits in the wild. Mozilla has officially addressed this issue in the stated fixed versions.

CVE-2026-16390 is a mitigation bypass vulnerability in the Enterprise Policies component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox 153 and Firefox ESR 140.13. It has a critical CVSS score of 9.1, indicating a high impact on confidentiality and integrity without requiring user interaction or privileges. The issue allows bypassing security mitigations intended to enforce enterprise policy controls.

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16388 is a sandbox escape vulnerability in the DOM Networking component of Mozilla Firefox. This critical vulnerability allows an attacker to potentially break out of the browser's sandbox environment. It affects Firefox versions prior to 153 and was fixed in Firefox 153. The vulnerability has a CVSS score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor advisory confirms the fix is available in Firefox 153.

CVE-2026-16387 is a site isolation vulnerability in the Networking component of Mozilla Firefox. This issue was addressed and fixed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a critical CVSS score of 9.8, indicating high severity with potential for remote exploitation without user interaction. Multiple related vulnerabilities affecting Firefox and Thunderbird were fixed in these versions. There are no confirmed exploits in the wild for this specific issue. The vendor advisory confirms the availability of an official fix.

CVE-2026-16386 is an information disclosure vulnerability in Mozilla Firefox's Graphics: WebGPU component caused by uninitialized memory. This flaw allows unauthorized disclosure of information but does not affect integrity or availability. The vulnerability was fixed in Firefox version 153. No known exploits are reported in the wild.

CVE-2026-16385 is an information disclosure vulnerability in Mozilla Firefox's Graphics: WebGPU component caused by uninitialized memory. This flaw allows unauthorized disclosure of information due to improper memory handling. The vulnerability affects Firefox versions prior to 153 and was fixed in Firefox 153. The issue has a high severity rating with a CVSS score of 7.5. There are no known exploits in the wild at the time of disclosure. The vendor advisory confirms the fix is included in Firefox 153.

CVE-2026-16384 is an information disclosure vulnerability in Mozilla Firefox's Graphics: WebGPU component caused by uninitialized memory. This flaw allows unauthorized disclosure of potentially sensitive information. The vulnerability was fixed in Firefox version 153 and Thunderbird version 153. It has a CVSS 3.1 base score of 7.5, indicating high severity. No known exploits in the wild have been reported. The issue affects Firefox versions prior to 153.

CVE-2026-16383 is a mitigation bypass vulnerability in the DOM: Networking component of Mozilla Firefox. It was addressed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a critical CVSS score of 9.8, indicating high severity with potential for complete confidentiality, integrity, and availability impact. Mozilla has released official fixes for this and multiple related vulnerabilities in Firefox 153 and Firefox ESR 140.13. There are no known exploits in the wild at the time of the advisory.

CVE-2026-16382 is a mitigation bypass vulnerability in the DOM Service Workers component of Mozilla Firefox. It affects Firefox versions prior to 153 and was fixed in Firefox 153. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix is included in Firefox 153. No known exploits in the wild have been reported. This issue is part of a broader set of security fixes released in Firefox 153 and Thunderbird 153.

CVE-2026-16381 is a same-origin policy bypass vulnerability in the Networking: DNS component of Mozilla Firefox. This vulnerability allows bypassing the same-origin policy, which is a critical security control in web browsers. The issue was fixed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a CVSS score of 9.1, indicating critical severity. No known exploits in the wild have been reported. Mozilla has released official patches addressing this and multiple other high-impact vulnerabilities in Firefox 153 and Firefox ESR 140.13.

CVE-2026-16380 is a mitigation bypass vulnerability in the Networking component of Mozilla Firefox. This issue was fixed in Firefox version 153. The vulnerability has a high CVSS score of 9.1, indicating critical severity. It allows an attacker to bypass security mitigations, potentially leading to high impact on confidentiality and integrity without requiring user interaction or privileges. The vulnerability affects Firefox versions prior to 153. Mozilla has released an official fix in Firefox 153 to address this issue.

CVE-2026-16358 is a site isolation vulnerability in the Graphics: WebRender component of Mozilla Firefox. It was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor advisories confirm the fix availability in the stated versions.

Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16378 is a vulnerability in Mozilla Firefox affecting the DOM Copy & Paste and Drag & Drop component. It was fixed in Firefox version 153. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with a network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality. The issue allows unauthorized access to information but does not affect integrity or availability. Mozilla has released an official fix in Firefox 153. No known exploits in the wild have been reported.

CVE-2026-16377 is a mitigation bypass vulnerability in the PDF Viewer component of Mozilla Firefox. It was fixed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a critical CVSS score of 9.8 and allows an attacker to bypass security mitigations, potentially leading to high impact on confidentiality, integrity, and availability. Mozilla has released official fixes in the specified versions. There are no known exploits in the wild at the time of the advisory.