Critical· 9.1official fix available
CVE-2026-16406
A mitigation bypass flaw exists in the networking component of Mozilla Firefox, rated critical with a CVSS score of 9.1. The vulnerability was fixed in Firefox version 153 (and Thunderbird 153). No known exploitation or public exploit is currently reported.
publishedJul 21, 2026
last modifiedJul 22, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
<1%
16th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 20, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of Mozilla Firefox.
02
Real-world impact
An attacker could potentially bypass security mitigations, leading to high confidentiality and integrity impacts.
03
Why this severity
The CVSS v3.1 base score of 9.1 reflects a network‑adjacent attack with low complexity, no privileges or user interaction required, and high impacts on confidentiality and integrity.
04
What to do about it
official fix available
recommended steps
- 01Upgrade Mozilla Firefox to version 153 or later.
NVD-referenced vendor advisory
05
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
07
References & advisories
- bugzilla.mozilla.org/show_bug.cgipermissions required
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →