Threat database

CVE-2026-16376 is a denial-of-service vulnerability in the Graphics: WebGPU component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 153. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating it can cause significant disruption by impacting availability. There are no known exploits in the wild at this time. The vulnerability affects all Firefox versions prior to 153.

CVE-2026-16375 is a site isolation vulnerability in the Networking: HTTP component of Mozilla Firefox. This issue was addressed and fixed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor advisory confirms the availability of an official fix in the specified versions.

CVE-2026-16374 is an information disclosure vulnerability in the Framework component of Mozilla Firefox DevTools. It was addressed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a high CVSS score of 7.5 and allows an attacker to gain unauthorized access to information. No known exploits in the wild have been reported. Mozilla has released official fixes in the specified versions.

CVE-2026-16373 is an information disclosure vulnerability in the Privacy component of Firefox for Android. This vulnerability allows unauthorized access to sensitive information. It was fixed in Firefox version 153. The vulnerability has a high severity rating with a CVSS score of 7.5. No known exploits in the wild have been reported. Users running versions prior to 153 are affected.

Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.

CVE-2026-16370 is a mitigation bypass vulnerability in the DOM: Networking component of Mozilla Firefox. It affects Firefox versions prior to 153 and was fixed in Firefox 153. The vulnerability has a high CVSS score of 9.1, indicating critical severity. The issue allows bypassing security mitigations related to networking in the DOM, potentially impacting confidentiality and integrity. Mozilla has released an official fix in Firefox 153 to address this vulnerability.

CVE-2026-16357 is a critical vulnerability in Mozilla Firefox's Graphics component caused by incorrect boundary conditions. This flaw allows potential memory safety issues that could lead to high impact on confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. No known exploits in the wild have been reported. The CVSS v3.1 base score is 9.8, indicating critical severity.

CVE-2026-16356 is a critical use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox and Thunderbird. This flaw allows sandbox escape, potentially enabling an attacker to execute arbitrary code outside the browser's sandbox. The vulnerability is fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS score is 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

CVE-2026-16355 is a critical vulnerability in Mozilla Firefox's JavaScript Engine JIT component involving miscompilation. This flaw could lead to severe impacts including confidentiality, integrity, and availability breaches. The issue was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. No known exploits in the wild have been reported. The vulnerability has a CVSS score of 9.8, indicating critical severity.

CVE-2026-16369 is a critical integer overflow vulnerability in the JavaScript: WebAssembly component of Mozilla Firefox. This flaw could lead to severe impacts including complete compromise of confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. No known exploits in the wild have been reported at the time of disclosure.

CVE-2026-16368 is a critical vulnerability in Mozilla Firefox involving incorrect boundary conditions in the JavaScript: WebAssembly component. This flaw could lead to severe impacts including full confidentiality, integrity, and availability compromise. The vulnerability affects Firefox versions prior to 153 and Firefox ESR versions prior to 140.13. Mozilla has released official fixes in Firefox 153 and Firefox ESR 140.13. There are no known exploits in the wild at this time. The CVSS v3.1 score is 9.8, indicating a critical severity level.

CVE-2026-16367 is a critical vulnerability in Mozilla Firefox involving a sandbox escape caused by an invalid pointer in the Disability Access APIs component. This flaw allows an attacker to potentially break out of the browser's sandbox environment, leading to full system compromise. The vulnerability was fixed in Firefox version 153. It has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and complete confidentiality, integrity, and availability impact.

CVE-2026-16354 is an information disclosure vulnerability in the Graphics: ImageLib component of Mozilla Firefox. This flaw allows unauthorized disclosure of information without impacting integrity or availability. The vulnerability has been fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. It carries a high severity rating with a CVSS score of 7.5. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate this issue.

CVE-2026-16353 is a critical vulnerability in Mozilla Firefox involving an invalid pointer in the DOM: Bindings (WebIDL) component. This flaw could lead to severe impacts including potential arbitrary code execution due to memory corruption. The vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. No known exploits in the wild have been reported. The CVSS score is 9.8, indicating a critical severity level.

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16363 is a critical vulnerability in Mozilla Firefox involving a Just-In-Time (JIT) miscompilation issue in the JavaScript WebAssembly component. This flaw could lead to high impact consequences including confidentiality, integrity, and availability breaches. The vulnerability affects Firefox versions prior to 153 and Firefox ESR versions prior to 140.13. Mozilla has released official fixes in Firefox 153 and Firefox ESR 140.13. There are no known exploits in the wild at this time. The issue is part of a broader set of high-impact security fixes addressed simultaneously by Mozilla.

CVE-2026-16352 is a critical use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox and Thunderbird. This flaw allows sandbox escape, potentially enabling an attacker to break out of the restricted execution environment. The vulnerability has been fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS score is 9.8, indicating a high severity with network attack vector, no required privileges or user interaction, and full confidentiality, integrity, and availability impact.