Threats Tagged 'cve-2026-16394'

This security update for Mozilla Firefox and related components addresses multiple critical security vulnerabilities, including privilege escalations, use-after-free bugs, information disclosures, mitigation bypasses, same-origin policy bypasses, integer overflows, race conditions, and denial-of-service issues. The update corresponds to Firefox Extended Support Release 153.1.0 ESR and includes fixes for numerous CVEs affecting various components such as Graphics, JavaScript engine, DOM, Networking, and more. Additionally, new features like profile management and Split View are introduced in Firefox ESR 153.0. The update is critical due to the wide range of security issues fixed.

CVE-2026-16349 is a critical vulnerability in Mozilla Firefox involving a same-origin policy bypass in the DOM Navigation component. This flaw allows unauthorized access across origins, violating web security boundaries. The issue was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate the risk.

CVE-2026-16394 is a mitigation bypass vulnerability in the DOM security component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox version 153. It has a high CVSS score of 9.1, indicating critical severity with high impact on confidentiality and integrity. The issue affects all Firefox versions prior to 153. The vendor advisory confirms the fix is included in Firefox 153. There are no known exploits in the wild at this time.