Threat Intelligence Database

Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16387 is a site isolation vulnerability in the Networking component of Mozilla Firefox. This issue was addressed and fixed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a critical CVSS score of 9.8, indicating high severity with potential for remote exploitation without user interaction. Multiple related vulnerabilities affecting Firefox and Thunderbird were fixed in these versions. There are no confirmed exploits in the wild for this specific issue. The vendor advisory confirms the availability of an official fix.

CVE-2026-16381 is a same-origin policy bypass vulnerability in the Networking: DNS component of Mozilla Firefox. This vulnerability allows bypassing the same-origin policy, which is a critical security control in web browsers. The issue was fixed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a CVSS score of 9.1, indicating critical severity. No known exploits in the wild have been reported. Mozilla has released official patches addressing this and multiple other high-impact vulnerabilities in Firefox 153 and Firefox ESR 140.13.

Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16377 is a mitigation bypass vulnerability in the PDF Viewer component of Mozilla Firefox. It was fixed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a critical CVSS score of 9.8 and allows an attacker to bypass security mitigations, potentially leading to high impact on confidentiality, integrity, and availability. Mozilla has released official fixes in the specified versions. There are no known exploits in the wild at the time of the advisory.

CVE-2026-16374 is an information disclosure vulnerability in the Framework component of Mozilla Firefox DevTools. It was addressed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a high CVSS score of 7.5 and allows an attacker to gain unauthorized access to information. No known exploits in the wild have been reported. Mozilla has released official fixes in the specified versions.

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16369 is a critical integer overflow vulnerability in the JavaScript: WebAssembly component of Mozilla Firefox. This flaw could lead to severe impacts including complete compromise of confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. No known exploits in the wild have been reported at the time of disclosure.

CVE-2026-16368 is a critical vulnerability in Mozilla Firefox involving incorrect boundary conditions in the JavaScript: WebAssembly component. This flaw could lead to severe impacts including full confidentiality, integrity, and availability compromise. The vulnerability affects Firefox versions prior to 153 and Firefox ESR versions prior to 140.13. Mozilla has released official fixes in Firefox 153 and Firefox ESR 140.13. There are no known exploits in the wild at this time. The CVSS v3.1 score is 9.8, indicating a critical severity level.