CVE-2026-16389
CVE-2026-16389 is a critical integer overflow vulnerability in the NSS Libraries component affecting Mozilla Firefox and Thunderbird. It allows remote attackers to compromise confidentiality, integrity, and availability. The issue was resolved in Firefox 153 and Thunderbird 153.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Mozilla Firefox and Thunderbird (specific versions not listed in CPE data).
Real-world impact
No known exploitation in the wild or public exploit reported.
Why this severity
CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
- 011. Upgrade Mozilla Firefox to version 153 or later.
- 022. Upgrade Mozilla Thunderbird to version 153 or later.
NVD description (fix specified in Firefox 153 and Thunderbird 153).
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 24, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- bugzilla.mozilla.org/show_bug.cgipermissions required
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory