CVE-2026-16411

CVE-2026-16411 affects Firefox 152, with memory safety bugs that show evidence of memory corruption and could potentially be exploited to run arbitrary code. The issue is mitigated by upgrading to Firefox 153 (the fix is listed as per sources). The NVD entry notes a high-severity impact (CVSS 3.1...

CVE-2026-16410

CVE-2026-16410: A JIT miscompilation in the JavaScript Engine's JIT component of Firefox was fixed in Firefox 153. Affected versions are prior to 153; use of the vulnerable JIT code could lead to high-severity impact per reported CVSS metrics (CRITICAL, HIGH confidentiality, integrity, availabili...

CVE-2026-16409

CVE-2026-16409 is an invalid pointer issue in the Security: PSM component that affects Firefox and Thunderbird. The vulnerability is documented as fixed in Firefox 153 and Thunderbird 153, with a CVSS 3.1 base score of 7.5 (High) and an exploit vector of NETWORK with no user interaction required....

CVE-2026-16407

The CVE-2026-16407 entry describes a mitigation bypass in the DOM: Service Workers component. Affected software is Mozilla Firefox (and dependent Thunderbird) prior to version 153, with the underlying issue addressed by fixes in Firefox 153/Thunderbird 153. The practical impact is a bypass of mit...

CVE-2026-16408

CVE-2026-16408 describes an Integer overflow in the Audio/Video: Playback component. Affected software is Mozilla Firefox; fixed in Firefox 153. CVSS: 3.1, CRITICAL (9.8), Network attack, no user interaction, impact on confidentiality, integrity, and availability HIGH. Other sources corroborate t...

CVE-2026-16406

CVE-2026-16406: A mitigation bypass in the Networking component was reported for Firefox; the vulnerability is addressed by Firefox 153. The available sources do not specify the exact root cause, affected subcomponents, or exploitation details beyond the fix version. CVSSv3.1 metrics are provided...

CVE-2026-16405

CVE-2026-16405 is an information disclosure vulnerability in Firefox’s Networking: WebSockets component. The issue affects the WebSockets handling and has a high confidentiality impact; it was fixed in Firefox 153 and Firefox ESR 140.13. Current sources do not provide exploit details or in-the-wi...

CVE-2026-16404

CVE-2026-16404 is a spoofing vulnerability in Firefox for Android with a CVSS v3.1 base score of 7.4 (HIGH) . The issue affects the Android flavor of Firefox and was fixed in Firefox 153 . Other connected sources corroborate the same description. No additional technical details (root cause, affec...

CVE-2026-16403

CVE-2026-16403 affects Mozilla Firefox’s Address Bar spoofing functionality. The connected sources consistently identify a spoofing issue in the Address Bar component that was fixed in Firefox 153. Details across SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, and CVE listings corroborate the same root ca...

CVE-2026-16401

Vulnerability CVE-2026-16401 is a privilege-escalation issue in the Data Loss Prevention component affecting Firefox and Thunderbird. The flaw, classified as high impact (CVSSv3.1: 8.8, CONF/I/H/A), is mitigated by upgrading to Firefox 153 and Thunderbird 153. The CVSS vector indicates network at...

CVE-2026-16402

CVE-2026-16402 describes an integer overflow in the Graphics: ImageLib component. The vulnerability is confirmed across multiple advisories and vendors (SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, CVE.org, etc.). The issue is fixed in Firefox version 153. The available connected sources do not provide...

CVE-2026-16400

Technical details (affected products, components, versions, and fixes) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-16399

Technical details about CVE-2026-16399 are not publicly available in the provided documents. The sources summarize a site isolation issue in the DOM: Navigation component with Firefox fix in version 153. Monitor for updates.

CVE-2026-16398

CVE-2026-16398 is a site isolation issue in Firefox's Graphics component. Affected product: Mozilla Firefox prior to version 153. Root cause: site isolation in the Graphics component. Impact: confidentiality impact (C), no integrity or availability impact described; CVSSv3.1 shows 7.5 (HIGH) with...

CVE-2026-16397

CVE-2026-16397 describes a clickjacking vulnerability in the WebExtensions component of Firefox for Android. The issue affects the WebExtensions surface and was addressed with a product update, fixed in Firefox 153. The CVSS 3.1 vector indicates network access, low attack complexity, no privilege...

CVE-2026-16396

CVE-2026-16396 is a privilege-escalation issue in WebExtensions that affects Mozilla Firefox and Thunderbird components. Public advisories indicate the vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS data from the initial document show...

CVE-2026-16395

CVE-2026-16395 : Integer overflow in the Audio/Video component of Firefox. root cause: integer overflow within the media handling path. Impact per sources: high confidentiality, integrity, and availability should be considered given the CVSS vector indicates network attack vector with no user int...

CVE-2026-16394

CVE-2026-16394 describes a mitigation bypass in the DOM: Security component of the Firefox browser. The issue is reported as affecting the DOM/Security component and has been fixed in Firefox 153. The CVSS 3.1 vector indicates Network attack vector, low complexity, no privileges required, with us...

CVE-2026-16359

CVE-2026-16359 concerns Mozilla Firefox’s Audio/Video: GMP component. The root cause is described as incorrect boundary conditions in this GMP-related path. The vulnerability is rated with CVSS 3.1 base score 9.1 (Network, Low Attack Complexity, No Privileges Required, User Interaction None, Conf...

CVE-2026-16393

CVE-2026-16393 affects the Graphics: WebGPU component in Firefox. The root cause is incorrect boundary conditions in this component, leading to a potential impact on confidentiality and availability (C:H I:N A:H) with a high-severity rating (CVSS 3.1: 9.1, Network attack, no user interaction). Th...

CVE-2026-16392

CVE-2026-16392 concerns a JIT miscompilation in the JavaScript Engine: JIT component. Multiple connected advisories indicate this issue affects Firefox/Thunderbird releases prior to version 153 and has been fixed in Firefox 153 and Thunderbird 153. Public details in the provided documents specify...

CVE-2026-16391

Information disclosure in Firefox’s Storage: IndexedDB component (CVE-2026-16391) is addressed in Firefox 153 and Firefox ESR 140.13. The CVSSv3.1 vector indicates an unaltered scope, network attack vector, high confidentiality impact with no impact to integrity/availability, and no user interact...

CVE-2026-16390

CVE-2026-16390 describes a mitigation bypass in the Firefox Enterprise Policies component. The vulnerability is indicated as fixed in Firefox 153 and Firefox ESR 140.13. The initial entry provides a CVSS 3.1 base score of 9.1 (CRITICAL) with network attack vector, low attack complexity, and no us...

CVE-2026-16389

CVE-2026-16389 affects the Libraries component of NSS. The root cause is described as incorrect boundary conditions that lead to an integer overflow. The vulnerability is rated high (CVSS v3.1 base score 9.8; CRITICAL; network attack vector, no privileges, no user interaction) and would impact sy...

CVE-2026-16388

CVE-2026-16388 concerns a sandbox escape in the DOM within Firefox’ s Networking component. The available documents identify the affected software as Mozilla Firefox (DOM/Networking code path) and state the vulnerability was fixed in Firefox 153. The description provided does not reveal a detaile...

CVE-2026-16387

CVE-2026-16387 is a site isolation issue in the Mozilla Firefox Networking component. The vulnerability is fixed in Firefox 153 and Firefox ESR 140.13. The available documents do not specify the exact vulnerable versions beyond the fix, nor do they provide exploitation details. Affected software ...

CVE-2026-16386

CVE-2026-16386 : Information disclosure caused by uninitialized memory in the Graphics: WebGPU component of Firefox. Affected product: Firefox (Graphics: WebGPU). Root cause: uninitialized memory leading to leakage of information. Impact as per source: Confidentiality impact HIGH; overall CVSSv3....

CVE-2026-16385

CVE-2026-16385 is a information-disclosure vulnerability in Firefox related to the Graphics: WebGPU component caused by uninitialized memory. The issue affects Firefox versions prior to 153 and is fixed in Firefox 153. The CVE description and cross-reference set describe the vulnerability as an i...

CVE-2026-16383

CVE-2026-16383 is a mitigation bypass in the DOM: Networking component. It affects Firefox (including ESR) and Thunderbird where the issue was addressed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The root cause is described as a DOM mitigation bypass within the N...

CVE-2026-16384

CVE-2026-16384 : Information disclosure caused by uninitialized memory in Firefox’s Graphics: WebGPU component. Affected product: Firefox (Graphics: WebGPU). Root cause: uninitialized memory leading to potential leakage. Impact per CVSS: Confidentiality High; no integrity/availability impact repo...

CVE-2026-16382

CVE-2026-16382 is a critical mitigation-bypass vulnerability in the Firefox DOM: Service Workers component. The issue affects Firefox versions prior to 153 and is fixed in Firefox 153. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation details are not provided in t...

CVE-2026-16381

CVE-2026-16381 affects Mozilla Firefox (Networking: DNS component). It is a same-origin policy bypass vulnerability with a CVSS v3.1 base score of 9.1 (CRITICAL). The description indicates the issue was fixed in Firefox 153 and Firefox ESR 140.13. The connected sources confirm the fix versions; n...

CVE-2026-16380

CVE-2026-16380 describes a mitigation bypass in the Networking component of Mozilla Firefox. The issue is characterized in the sources as a bypass vulnerability that was fixed in Firefox 153. The affected product is Mozilla Firefox; detailed root cause and affected subcomponents are not explicitl...

CVE-2026-16358

Summary: CVE-2026-16358 is a site-isolation issue in the Graphics: WebRender component of Mozilla Firefox/Firefox ESR. The underlying problem is within WebRender's handling of cross-origin/site isolation, and it has been fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected p...

CVE-2026-16379

Technical details for CVE-2026-16379 are not provided in the supplied documents. The initial entry mentions privilege escalation in the DOM Content Processes component and fixes in Firefox/Thunderbird versions, but lacks root cause, affected products, or remediation specifics.

CVE-2026-16377

Mitigation bypass in Firefox’s PDF Viewer component (CVE-2026-16377) is confirmed. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. According to the sources, the CVSSv3.1 base score is 9.8 (CRITICAL) with network attack vector, low complexity, and no user interaction required, a...

CVE-2026-16378

CVE-2026-16378 concerns a DOM-related issue in Firefox’s Copy & Paste and Drag & Drop component. The vulnerability is fixed in Firefox 153. CVSSv3.1 metrics indicate high impact with network attack vector, low complexity, no privileges, and no user interaction required, but the document does not ...

CVE-2026-16376

CVE-2026-16376 is a denial-of-service vulnerability in the Graphics: WebGPU component of Firefox. Affected software refers to Mozilla Firefox before version 153, where the issue was fixed in Firefox 153. The available sources confirm a DoS impact in the Graphics: WebGPU pipeline but do not provid...

CVE-2026-16375

CVE-2026-16375 affects Mozilla Firefox’s Networking: HTTP component with a site isolation issue. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. Affected product: Firefox (Networking: HTTP) with site isolation as the underlying bug. According to the provided documents, the CVSS...

CVE-2026-16374

The CVE-2026-16374 entry concerns information disclosure in the Framework component of Firefox DevTools. Affected product: Mozilla Firefox (DevTools Framework). Root cause/impact: information disclosure; CVSS_BASE score 7.5 (HIGH) with network access and no user interaction. Mitigation: upgrade t...

CVE-2026-16373

CVE-2026-16373 is an information-disclosure vulnerability affecting Mozilla Firefox for Android (Privacy component). The public records show the issue was fixed in Firefox 153, with advisories indicating information disclosure could be obtained in the affected component. The entry also notes affe...

CVE-2026-16372

CVE-2026-16372 — Privilege escalation in the DOM: Content Processes component. Affected products: Firefox and Thunderbird. The provided documents do not reveal the exact root cause or vulnerable files. CVSS 3.1 base score 8.8 (HIGH) with Network access, no privileges required, user interaction ne...

CVE-2026-16371

CVE-2026-16371: Privilege escalation in the DOM: Navigation component. The Mozilla advisories indicate this affects Firefox and Thunderbird products and is fixed in Firefox 153 / ESR 140.13 and Thunderbird 153 / 140.13. Remediation: upgrade to Firefox 153 (or ESR 140.13) and Thunderbird 153 (or 1...

CVE-2026-16370

CVE-2026-16370 is a mitigation bypass vulnerability in the DOM Networking component of Mozilla Firefox. Affected product: Mozilla Firefox earlier than 153.0. Root cause: mitigation bypass in the DOM: Networking component, resolved by the Firefox 153 release. Impact as described in sources: high c...

CVE-2026-16357

CVE-2026-16357 is a Mozilla Firefox/Firefox ESR vulnerability caused by incorrect boundary conditions in the Graphics component. Affected product: Firefox and Firefox ESR. The issue is tracked with a CVSS 3.1 base score of 9.8 (CRITICAL) with network attack vector, no user interaction, and possib...

CVE-2026-16356

CVE-2026-16356 describes a sandbox-escape use-after-free flaw in Mozilla Firefox’s Disability Access APIs component. The NVD entry notes this vulnerability affects Firefox desktop products and was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. The consolidated feeds (NVD, Debia...

CVE-2026-16355

JIT miscompilation in the JavaScript Engine (JIT component) for Mozilla Firefox ESR and Firefox affects Firefox ESR releases earlier than 115.38. The issue is fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected entries from multiple sources confirm the vulnerability is tied...

CVE-2026-16369

CVE-2026-16369 : Integer overflow in the JavaScript: WebAssembly component of Mozilla Firefox. Affected: Firefox browser (WebAssembly/JavaScript engine). Root cause: integer overflow. Impact: fixed in Firefox 153 and Firefox ESR 140.13. Mitigation: upgrade Firefox to 153 (or ESR 140.13) to apply ...

CVE-2026-16368

CVE-2026-16368: Affects Firefox JavaScript/WebAssembly component due to incorrect boundary conditions. Root cause described as boundary-condition flaw with all three security properties potentially impacted (high confidentiality, integrity, availability). Public fixed versions: Firefox 153 and Fi...

CVE-2026-16367

CVE-2026-16367 affects Mozilla Firefox versions earlier than 153.0. The Sandboxing escape is due to an invalid pointer in the Disability Access APIs component, with the vulnerability fixed in Firefox 153. The CVSS v3.1 base score is 10.0 (CRITICAL), with Network attack vector, Low attack complexi...