CVE-2026-16394

CriticalCVSS 9.1

Published: 21/07/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

An attacker may bypass DOM security measures, potentially leading to code execution or data leakage.

Update Firefox and Thunderbird to version 153 or later.

Original NVD description (English source)

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.