Threat database

CVE-2026-16391 is an information disclosure vulnerability in the Storage: IndexedDB component of Mozilla Firefox and Thunderbird. The issue was resolved in Firefox 153 and Firefox ESR 140.13, as well as Thunderbird 153 and Thunderbird 140.13. This vulnerability could allow unauthorized access to certain information stored in IndexedDB. No known exploits are reported in the wild.

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.