Threats Tagged 'cve-2026-16374'

A critical security update for Mozilla Firefox Extended Support Release (ESR) 153.1.0 addresses multiple vulnerabilities across components such as graphics, JavaScript engine, DOM, and networking. The issues include use-after-free, privilege escalation, information disclosure, mitigation bypasses, same-origin policy bypass, integer overflow, race conditions, and denial-of-service. These vulnerabilities affect Firefox ESR 153.1.0 and related branding and translation packages.

These are all security issues fixed in the firefox-esr-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

CVE-2026-16349 is a critical vulnerability in Mozilla Firefox involving a same-origin policy bypass in the DOM Navigation component. This flaw allows unauthorized access across origins, violating web security boundaries. The issue was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate the risk.

Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16374 is an information disclosure vulnerability in the Framework component of Mozilla Firefox DevTools. It was addressed in Firefox 153 and Firefox ESR 140.13. The vulnerability has a high CVSS score of 7.5 and allows an attacker to gain unauthorized access to information. No known exploits in the wild have been reported. Mozilla has released official fixes in the specified versions.