CVE-2026-16375

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

Site isolation vulnerability in the HTTP networking component of Firefox. This issue was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Risk Assessment

An attacker could exploit this flaw to bypass site isolation, potentially leading to data leakage or cross-site attacks.

Recommendation

Immediately update Firefox and Thunderbird to the latest versions.

Other vulnerabilities in Firefox

See all

CVE-2026-92079Unknown
Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
CVE-2026-92078Unknown
Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
CVE-2026-92077Unknown
Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
CVE-2026-92076Unknown
Incorrect boundary conditions in the Networking component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
CVE-2026-92075Unknown
Mitigation bypass in the Networking component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
CVE-2026-92074Unknown
Mitigation bypass in the Popup Blocker component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
CVE-2026-92073High
A privilege escalation vulnerability in the Enterprise Policies component of Firefox and Thunderbird. It was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. It could allow an attacker to gain higher privileges on the system.
CVE-2026-92072Unknown
Incorrect boundary conditions in the Safe Browsing component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
CVE-2026-92071Unknown
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
CVE-2026-92070Unknown
Information disclosure in the Networking component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.

Original NVD description (English source)

Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.