CVE-2026-16387

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200CWE-284CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Jul 21, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-163889.8Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163899.8Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and ThunderbiCVE-2026-16396.5The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via thCVE-2026-163909.1Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, anCVE-2026-163917.5Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153CVE-2026-163929.1JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163939.1Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163949.1Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163959.8Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.CVE-2026-163968.8Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140CVE-2026-163976.5Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.CVE-2026-163987.5Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16387: Critical severity, CVSS 9.8 | Vulnix