Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0913
Vulnerability from certfr_avis - Published: 2026-07-23 - Updated: 2026-07-23
De multiples vulnérabilités ont été découvertes dans Mozilla Thunderbird. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Thunderbird ESR | Thunderbird ESR versions antérieures à 140.13 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 153 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Thunderbird ESR versions ant\u00e9rieures \u00e0 140.13",
"product": {
"name": "Thunderbird ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 153",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-16354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16354"
},
{
"name": "CVE-2026-16359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16359"
},
{
"name": "CVE-2026-15719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15719"
},
{
"name": "CVE-2026-16409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16409"
},
{
"name": "CVE-2026-16386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16386"
},
{
"name": "CVE-2026-16377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16377"
},
{
"name": "CVE-2026-16357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16357"
},
{
"name": "CVE-2026-16387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16387"
},
{
"name": "CVE-2026-16352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16352"
},
{
"name": "CVE-2026-16406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16406"
},
{
"name": "CVE-2026-16363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16363"
},
{
"name": "CVE-2026-16383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16383"
},
{
"name": "CVE-2026-16393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16393"
},
{
"name": "CVE-2026-16401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16401"
},
{
"name": "CVE-2026-16378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16378"
},
{
"name": "CVE-2026-16350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16350"
},
{
"name": "CVE-2026-16369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16369"
},
{
"name": "CVE-2026-16388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16388"
},
{
"name": "CVE-2026-16402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16402"
},
{
"name": "CVE-2026-16370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16370"
},
{
"name": "CVE-2026-16362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16362"
},
{
"name": "CVE-2026-16405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16405"
},
{
"name": "CVE-2026-16407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16407"
},
{
"name": "CVE-2026-16391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16391"
},
{
"name": "CVE-2026-14899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14899"
},
{
"name": "CVE-2026-16364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16364"
},
{
"name": "CVE-2026-16384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16384"
},
{
"name": "CVE-2026-16400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16400"
},
{
"name": "CVE-2026-16361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16361"
},
{
"name": "CVE-2026-16396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16396"
},
{
"name": "CVE-2026-16381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16381"
},
{
"name": "CVE-2026-16394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16394"
},
{
"name": "CVE-2026-16365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16365"
},
{
"name": "CVE-2026-16376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16376"
},
{
"name": "CVE-2026-16351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16351"
},
{
"name": "CVE-2026-16371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16371"
},
{
"name": "CVE-2026-16412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16412"
},
{
"name": "CVE-2026-16398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16398"
},
{
"name": "CVE-2026-16367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16367"
},
{
"name": "CVE-2026-16389",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16389"
},
{
"name": "CVE-2026-16399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16399"
},
{
"name": "CVE-2026-16375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16375"
},
{
"name": "CVE-2026-16408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16408"
},
{
"name": "CVE-2026-15718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15718"
},
{
"name": "CVE-2026-16385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16385"
},
{
"name": "CVE-2026-16382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16382"
},
{
"name": "CVE-2026-16410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16410"
},
{
"name": "CVE-2026-16374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16374"
},
{
"name": "CVE-2026-16379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16379"
},
{
"name": "CVE-2026-16353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16353"
},
{
"name": "CVE-2026-16380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16380"
},
{
"name": "CVE-2026-16349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16349"
},
{
"name": "CVE-2026-16366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16366"
},
{
"name": "CVE-2026-16390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16390"
},
{
"name": "CVE-2026-16356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16356"
},
{
"name": "CVE-2026-16358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16358"
},
{
"name": "CVE-2026-16403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16403"
},
{
"name": "CVE-2026-16360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16360"
},
{
"name": "CVE-2026-16355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16355"
},
{
"name": "CVE-2026-16392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16392"
},
{
"name": "CVE-2026-16368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16368"
},
{
"name": "CVE-2026-16372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16372"
},
{
"name": "CVE-2026-16395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16395"
},
{
"name": "CVE-2026-16411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16411"
}
],
"initial_release_date": "2026-07-23T00:00:00",
"last_revision_date": "2026-07-23T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0913",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-23T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mozilla Thunderbird. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Mozilla Thunderbird",
"vendor_advisories": [
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-71",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-71/"
},
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-72",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-72/"
}
]
}
CVE-2026-16377 (GCVE-0-2026-16377)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Mitigation bypass in the PDF Viewer component
Summary
Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
140.13 , ≤ 140.*
(rpm)
Unaffected: 153 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
140.13 , ≤ 140.*
(rpm)
Unaffected: 153 , ≤ * (rpm) |
Credits
Nikola Kojic
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T16:58:19.989629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:30:16.139Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.13",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.13",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nikola Kojic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
}
],
"value": "Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:39.146Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2037770"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
}
],
"title": "Mitigation bypass in the PDF Viewer component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16377",
"datePublished": "2026-07-21T12:37:52.135Z",
"dateReserved": "2026-07-20T21:56:42.653Z",
"dateUpdated": "2026-07-22T19:18:39.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16378 (GCVE-0-2026-16378)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Other issue in the DOM: Copy & Paste and Drag & Drop component
Summary
Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
153 , ≤ *
(rpm)
|
Credits
Farhad Sajid Barbhuiya
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T16:59:39.379191Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:30:09.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Farhad Sajid Barbhuiya"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Other issue in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"value": "Other issue in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:40.219Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2038868"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
}
],
"title": "Other issue in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16378",
"datePublished": "2026-07-21T12:37:52.990Z",
"dateReserved": "2026-07-20T21:56:44.836Z",
"dateUpdated": "2026-07-22T19:18:40.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16379 (GCVE-0-2026-16379)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-24 20:16
VLAI
EPSS
VEX
Title
Privilege escalation in the DOM: Content Processes component
Summary
Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
140.13 , ≤ 140.*
(rpm)
Unaffected: 153 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
140.13 , ≤ 140.*
(rpm)
Unaffected: 153 , ≤ * (rpm) |
Credits
Shu Takahashi
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T03:55:31.679939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T20:16:00.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.13",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.13",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Shu Takahashi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
}
],
"value": "Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:41.321Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2039452"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
}
],
"title": "Privilege escalation in the DOM: Content Processes component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16379",
"datePublished": "2026-07-21T12:37:53.832Z",
"dateReserved": "2026-07-20T21:56:46.680Z",
"dateUpdated": "2026-07-24T20:16:00.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16380 (GCVE-0-2026-16380)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Mitigation bypass in the Networking component
Summary
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
153 , ≤ *
(rpm)
|
Credits
Rintaro Kawasugi
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T17:09:56.037271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:29:42.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rintaro Kawasugi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"value": "Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:43.465Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2040386"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
}
],
"title": "Mitigation bypass in the Networking component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16380",
"datePublished": "2026-07-21T12:37:55.544Z",
"dateReserved": "2026-07-20T21:56:49.052Z",
"dateUpdated": "2026-07-22T19:18:43.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16381 (GCVE-0-2026-16381)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Same-origin policy bypass in the Networking: DNS component
Summary
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-346 - Origin Validation Error
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
140.13 , ≤ 140.*
(rpm)
Unaffected: 153 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
140.13 , ≤ 140.*
(rpm)
Unaffected: 153 , ≤ * (rpm) |
Credits
Rintaro Kawasugi
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T17:10:53.548670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:29:33.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.13",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.13",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rintaro Kawasugi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
}
],
"value": "Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:44.571Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041001"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
}
],
"title": "Same-origin policy bypass in the Networking: DNS component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16381",
"datePublished": "2026-07-21T12:37:56.371Z",
"dateReserved": "2026-07-20T21:56:51.463Z",
"dateUpdated": "2026-07-22T19:18:44.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16382 (GCVE-0-2026-16382)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Mitigation bypass in the DOM: Service Workers component
Summary
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
153 , ≤ *
(rpm)
|
Credits
Yaqoub Aldurayhim
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T17:11:47.817547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:29:26.937Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Yaqoub Aldurayhim"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"value": "Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:45.620Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041864"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
}
],
"title": "Mitigation bypass in the DOM: Service Workers component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16382",
"datePublished": "2026-07-21T12:37:57.200Z",
"dateReserved": "2026-07-20T21:56:53.743Z",
"dateUpdated": "2026-07-22T19:18:45.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16383 (GCVE-0-2026-16383)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Mitigation bypass in the DOM: Networking component
Summary
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
140.13 , ≤ 140.*
(rpm)
Unaffected: 153 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
140.13 , ≤ 140.*
(rpm)
Unaffected: 153 , ≤ * (rpm) |
Credits
Ibuki Sato and Tomoya Nakanishi
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T17:58:38.530727Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:28:33.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.13",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.13",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ibuki Sato and Tomoya Nakanishi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
}
],
"value": "Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:46.699Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041902"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
}
],
"title": "Mitigation bypass in the DOM: Networking component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16383",
"datePublished": "2026-07-21T12:37:58.017Z",
"dateReserved": "2026-07-20T21:56:56.113Z",
"dateUpdated": "2026-07-22T19:18:46.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16384 (GCVE-0-2026-16384)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Information disclosure due to uninitialized memory in the Graphics: WebGPU component
Summary
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
153 , ≤ *
(rpm)
|
Credits
5up3rh3i
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16384",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T17:12:40.841422Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "CWE-908 Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:29:18.889Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "5up3rh3i"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"value": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:47.737Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041911"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
}
],
"title": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16384",
"datePublished": "2026-07-21T12:37:58.866Z",
"dateReserved": "2026-07-20T21:56:57.902Z",
"dateUpdated": "2026-07-22T19:18:47.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16385 (GCVE-0-2026-16385)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Information disclosure due to uninitialized memory in the Graphics: WebGPU component
Summary
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
153 , ≤ *
(rpm)
|
Credits
5up3rh3i
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16385",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T17:13:24.400547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "CWE-908 Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:29:13.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "5up3rh3i"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"value": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:48.799Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041912"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
}
],
"title": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16385",
"datePublished": "2026-07-21T12:37:59.744Z",
"dateReserved": "2026-07-20T21:57:00.454Z",
"dateUpdated": "2026-07-22T19:18:48.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16386 (GCVE-0-2026-16386)
Vulnerability from cvelistv5 – Published: 2026-07-21 12:38 – Updated: 2026-07-22 19:18
VLAI
EPSS
VEX
Title
Information disclosure due to uninitialized memory in the Graphics: WebGPU component
Summary
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153 , ≤ *
(rpm)
|
|
| Mozilla | Thunderbird |
Unaffected:
153 , ≤ *
(rpm)
|
Credits
5up3rh3i
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-16386",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T17:14:20.823951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "CWE-908 Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:29:05.122Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "5up3rh3i"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"value": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T19:18:49.862Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041916"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
}
],
"title": "Information disclosure due to uninitialized memory in the Graphics: WebGPU component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-16386",
"datePublished": "2026-07-21T12:38:00.613Z",
"dateReserved": "2026-07-20T21:57:02.260Z",
"dateUpdated": "2026-07-22T19:18:49.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…