Critical· 9.1official fix available
CVE-2026-16392
A critical bug in the JavaScript engine can let attackers modify data or crash the program. It was fixed in recent releases of Firefox and Thunderbird.
publishedJul 21, 2026
last modifiedJul 28, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
<1%
31th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 27, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Firefox and Thunderbird users running versions older than 153.
02
Real-world impact
An attacker could alter data or cause the browser or email client to stop working, leading to data loss or denial of service.
03
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited remotely without any user action, and it can compromise integrity and availability of the affected software.
04
What to do about it
official fix available
recommended steps
- 01Upgrade Firefox to version 153 or later.
- 02Upgrade Thunderbird to version 153 or later.
- 03Restart the application to apply the update.
NVD description
05
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.
- Jul 28, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactNone
Integrity impactHigh
Availability impactHigh
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →