CVE-2026-16375
This vulnerability allows attackers to bypass site isolation in the HTTP networking component of Firefox and Thunderbird, potentially compromising confidentiality, integrity, and availability. It is critical because it can be exploited remotely without authentication or user interaction. The issue has been fixed in recent releases of both browsers.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Mozilla Firefox (versions before 153 and ESR 140.13) and Mozilla Thunderbird (versions before 153 and ESR 140.13).
Real-world impact
An attacker could exploit this to break site isolation, enabling cross‑site data theft, tampering, or denial of service across browsers.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited over the network with no authentication or user interaction, and it can compromise all data and functionality of the affected applications.
What to do about it
- 01Upgrade Firefox to version 153 or later, or ESR 140.13 or later.
- 02Upgrade Thunderbird to version 153 or later, or ESR 140.13 or later.
- 03Restart the application.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 24, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- bugzilla.mozilla.org/show_bug.cgipermissions required
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory