CVE-2026-16410
A flaw in the JavaScript engine’s just‑in‑time compiler can let attackers run arbitrary code on a victim’s machine. The bug is in Firefox and Thunderbird and was fixed in version 153. Users should update to the latest release to protect themselves.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Firefox and Thunderbird users running versions older than 153, such as Firefox 152 and earlier or Thunderbird 152 and earlier.
Real-world impact
An attacker could run malicious code on the victim’s computer, potentially taking full control, stealing data, or installing malware.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no user interaction, and gives an attacker complete control over the system.
What to do about it
- 011. Update Firefox to version 153 or later.
- 022. Update Thunderbird to version 153 or later.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 24, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- bugzilla.mozilla.org/show_bug.cgipermissions required
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory