Critical· 9.8official fix available
CVE-2026-16372
A critical vulnerability exists in the DOM Content Processes component of Firefox and Thunderbird. This flaw allows an attacker to escalate their privileges within the application.
publishedJul 21, 2026
last modifiedJul 24, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
19th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 22, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of Firefox and Thunderbird versions prior to 153.
02
Real-world impact
An attacker could gain higher levels of access or control within the browser or email client than they should normally have.
03
Why this severity
This is a critical vulnerability because it can be exploited remotely over a network without requiring any user interaction or special privileges, potentially leading to a total loss of confidentiality, integrity, and availability.
04
What to do about it
official fix available
recommended steps
- 011. Upgrade Firefox to version 153 or later.
- 022. Upgrade Thunderbird to version 153 or later.
NVD-referenced vendor advisory
05
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 24, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
- bugzilla.mozilla.org/show_bug.cgiexploitissue tracking
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →