Vulnerability-Lookup

ALSA-2026:49922 (CVE-2026-14899)

Vulnerability from osv_almalinux – Published: 2026-08-04 00:00 – Updated: 2026-08-04 16:48 – Source website

Summary

Important: thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:49922	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-14899	REPORT
	https://access.redhat.com/security/cve/CVE-2026-15718	REPORT
	https://access.redhat.com/security/cve/CVE-2026-15719	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16349	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16350	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16351	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16352	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16353	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16354	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16355	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16356	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16357	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16358	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16359	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16360	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16361	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16362	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16363	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16368	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16369	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16371	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16374	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16375	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16377	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16379	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16381	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16383	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16387	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16390	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16391	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16396	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16405	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16412	REPORT
	https://bugzilla.redhat.com/2499973	REPORT
	https://bugzilla.redhat.com/2499974	REPORT
	https://bugzilla.redhat.com/2503415	REPORT
	https://bugzilla.redhat.com/2503416	REPORT
	https://bugzilla.redhat.com/2503420	REPORT
	https://bugzilla.redhat.com/2503423	REPORT
	https://bugzilla.redhat.com/2503425	REPORT
	https://bugzilla.redhat.com/2503430	REPORT
	https://bugzilla.redhat.com/2503432	REPORT
	https://bugzilla.redhat.com/2503434	REPORT
	https://bugzilla.redhat.com/2503439	REPORT
	https://bugzilla.redhat.com/2503440	REPORT
	https://bugzilla.redhat.com/2503444	REPORT
	https://bugzilla.redhat.com/2503451	REPORT
	https://bugzilla.redhat.com/2503454	REPORT
	https://bugzilla.redhat.com/2503456	REPORT
	https://bugzilla.redhat.com/2503463	REPORT
	https://bugzilla.redhat.com/2503472	REPORT
	https://bugzilla.redhat.com/2503473	REPORT
	https://bugzilla.redhat.com/2503485	REPORT
	https://bugzilla.redhat.com/2503489	REPORT
	https://bugzilla.redhat.com/2503491	REPORT
	https://bugzilla.redhat.com/2503497	REPORT
	https://bugzilla.redhat.com/2503498	REPORT
	https://bugzilla.redhat.com/2503500	REPORT
	https://bugzilla.redhat.com/2503501	REPORT
	https://bugzilla.redhat.com/2503505	REPORT
	https://bugzilla.redhat.com/2503512	REPORT
	https://bugzilla.redhat.com/2503513	REPORT
	https://bugzilla.redhat.com/2503517	REPORT
	https://bugzilla.redhat.com/2503521	REPORT
	https://bugzilla.redhat.com/2503527	REPORT
	https://bugzilla.redhat.com/2506217	REPORT
	https://errata.almalinux.org/8/ALSA-2026-49922.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "thunderbird"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.13.0-1.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n  * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:49922",
  "modified": "2026-08-04T16:48:16Z",
  "published": "2026-08-04T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:49922"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14899"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15718"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15719"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16349"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16350"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16351"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16352"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16353"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16354"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16355"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16356"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16357"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16358"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16359"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16360"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16361"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16362"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16363"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16368"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16369"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16371"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16374"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16375"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16377"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16379"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16381"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16383"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16387"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16390"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16391"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16396"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16405"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16412"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2499973"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2499974"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503415"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503416"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503420"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503423"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503425"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503430"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503432"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503439"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503440"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503444"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503451"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503454"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503472"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503473"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503485"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503489"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503491"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503497"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503498"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503500"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503501"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503505"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503512"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503513"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503517"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503521"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503527"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2506217"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-49922.html"
    }
  ],
  "related": [
    "CVE-2026-14899",
    "CVE-2026-15718",
    "CVE-2026-15719",
    "CVE-2026-16349",
    "CVE-2026-16350",
    "CVE-2026-16351",
    "CVE-2026-16352",
    "CVE-2026-16353",
    "CVE-2026-16354",
    "CVE-2026-16355",
    "CVE-2026-16356",
    "CVE-2026-16357",
    "CVE-2026-16358",
    "CVE-2026-16359",
    "CVE-2026-16360",
    "CVE-2026-16361",
    "CVE-2026-16362",
    "CVE-2026-16363",
    "CVE-2026-16368",
    "CVE-2026-16369",
    "CVE-2026-16371",
    "CVE-2026-16374",
    "CVE-2026-16375",
    "CVE-2026-16377",
    "CVE-2026-16379",
    "CVE-2026-16381",
    "CVE-2026-16383",
    "CVE-2026-16387",
    "CVE-2026-16390",
    "CVE-2026-16391",
    "CVE-2026-16396",
    "CVE-2026-16405",
    "CVE-2026-16412"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: thunderbird security update",
  "upstream": [
    "CVE-2026-14899",
    "CVE-2026-15718",
    "CVE-2026-15719",
    "CVE-2026-16349",
    "CVE-2026-16350",
    "CVE-2026-16351",
    "CVE-2026-16352",
    "CVE-2026-16353",
    "CVE-2026-16354",
    "CVE-2026-16355",
    "CVE-2026-16356",
    "CVE-2026-16357",
    "CVE-2026-16358",
    "CVE-2026-16359",
    "CVE-2026-16360",
    "CVE-2026-16361",
    "CVE-2026-16362",
    "CVE-2026-16363",
    "CVE-2026-16368",
    "CVE-2026-16369",
    "CVE-2026-16371",
    "CVE-2026-16374",
    "CVE-2026-16375",
    "CVE-2026-16377",
    "CVE-2026-16379",
    "CVE-2026-16381",
    "CVE-2026-16383",
    "CVE-2026-16387",
    "CVE-2026-16390",
    "CVE-2026-16391",
    "CVE-2026-16396",
    "CVE-2026-16405",
    "CVE-2026-16412"
  ]
}

CVE-2026-14899 (GCVE-0-2026-14899)

Vulnerability from cvelistv5 – Published: 2026-07-22 19:19 – Updated: 2026-07-27 17:12

Title

Off-by-one out of bounds read in MIME header parser for forwarding

Summary

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 17:12 UTC

CWE

CWE-193 - Off-by-one Error

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

3 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2046137
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

1 product

Vendor	Product	Version
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Claude, Kai Engert

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-14899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T17:12:35.358996Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-193",
                "description": "CWE-193 Off-by-one Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T17:12:52.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Claude, Kai Engert"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13."
            }
          ],
          "value": "The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:19:42.305Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2046137"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Off-by-one out of bounds read in MIME header parser for forwarding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-14899",
    "datePublished": "2026-07-22T19:19:42.305Z",
    "dateReserved": "2026-07-06T19:53:12.713Z",
    "dateUpdated": "2026-07-27T17:12:52.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15718 (GCVE-0-2026-15718)

Vulnerability from cvelistv5 – Published: 2026-07-14 12:15 – Updated: 2026-07-22 19:19

Title

Invalid pointer in the JavaScript: WebAssembly component

Summary

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 13:34 UTC

CWE

CWE-763 - Release of Invalid Pointer or Reference

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

4 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2045443
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 152.0.6 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ * (rpm)

Credits

Christian Holler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T13:34:48.369595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-763",
                "description": "CWE-763 Release of Invalid Pointer or Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T13:35:17.223Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "152.0.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Christian Holler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13."
            }
          ],
          "value": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:19:21.078Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2045443"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-67/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Invalid pointer in the JavaScript: WebAssembly component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-15718",
    "datePublished": "2026-07-14T12:15:46.176Z",
    "dateReserved": "2026-07-14T12:15:45.500Z",
    "dateUpdated": "2026-07-22T19:19:21.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15719 (GCVE-0-2026-15719)

Vulnerability from cvelistv5 – Published: 2026-07-14 12:15 – Updated: 2026-07-22 19:19

Title

Site isolation issue in the DOM: Navigation component

Summary

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 13:32 UTC

CWE

CWE-noinfo Not enough information

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2043820
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 152.0.6 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ * (rpm)

Credits

Atsushi Sada

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15719",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T13:32:24.747872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T13:33:56.522Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "152.0.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Atsushi Sada"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13."
            }
          ],
          "value": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:19:22.168Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2043820"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-67/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Site isolation issue in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-15719",
    "datePublished": "2026-07-14T12:15:47.592Z",
    "dateReserved": "2026-07-14T12:15:46.894Z",
    "dateUpdated": "2026-07-22T19:19:22.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16349 (GCVE-0-2026-16349)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Same-origin policy bypass in the DOM: Navigation component

Summary

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 15:19 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2034682
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Tran Quac

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16349",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:19:58.133285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:44.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tran Quac"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:14.229Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2034682"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Same-origin policy bypass in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16349",
    "datePublished": "2026-07-21T12:37:31.917Z",
    "dateReserved": "2026-07-20T21:55:46.392Z",
    "dateUpdated": "2026-07-22T19:18:14.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16350 (GCVE-0-2026-16350)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Incorrect boundary conditions in the Audio/Video: cubeb component

Summary

Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 15:20 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2042033
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Tomoya Nakanishi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16350",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:20:58.436609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:34.754Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tomoya Nakanishi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:15.333Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2042033"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Incorrect boundary conditions in the Audio/Video: cubeb component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16350",
    "datePublished": "2026-07-21T12:37:32.759Z",
    "dateReserved": "2026-07-20T21:55:48.638Z",
    "dateUpdated": "2026-07-22T19:18:15.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16351 (GCVE-0-2026-16351)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Sandbox escape due to use-after-free in the DOM: Navigation component

Summary

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 15:21 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2045468
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Yaqoub Aldurayhim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16351",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:21:54.902342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:28.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaqoub Aldurayhim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:17.433Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2045468"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16351",
    "datePublished": "2026-07-21T12:37:34.438Z",
    "dateReserved": "2026-07-20T21:55:50.743Z",
    "dateUpdated": "2026-07-22T19:18:17.433Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16352 (GCVE-0-2026-16352)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Sandbox escape due to use-after-free in the Disability Access APIs component

Summary

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 15:23 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2046416
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16352",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:23:05.783737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:18.943Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:18.625Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2046416"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the Disability Access APIs component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16352",
    "datePublished": "2026-07-21T12:37:35.292Z",
    "dateReserved": "2026-07-20T21:55:52.955Z",
    "dateUpdated": "2026-07-22T19:18:18.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16353 (GCVE-0-2026-16353)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Invalid pointer in the DOM: Bindings (WebIDL) component

Summary

Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 15:32 UTC

CWE

CWE-824 - Access of Uninitialized Pointer
CWE-416 - Use After Free
CWE-476 - NULL Pointer Dereference

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2049523
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

fedek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16353",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:32:12.984529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-824",
                "description": "CWE-824 Access of Uninitialized Pointer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:45:33.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "fedek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:24.106Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2049523"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Invalid pointer in the DOM: Bindings (WebIDL) component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16353",
    "datePublished": "2026-07-21T12:37:39.485Z",
    "dateReserved": "2026-07-20T21:55:55.027Z",
    "dateUpdated": "2026-07-22T19:18:24.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16354 (GCVE-0-2026-16354)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Information disclosure in the Graphics: ImageLib component

Summary

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 15:33 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2050626
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

satyamasd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16354",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:33:47.108874Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:45:27.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "satyamasd"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:25.205Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2050626"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Information disclosure in the Graphics: ImageLib component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16354",
    "datePublished": "2026-07-21T12:37:40.337Z",
    "dateReserved": "2026-07-20T21:55:56.965Z",
    "dateUpdated": "2026-07-22T19:18:25.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16355 (GCVE-0-2026-16355)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

JIT miscompilation in the JavaScript Engine: JIT component

Summary

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 15:37 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2052207
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Amy Burnett of OpenAI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16355",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:37:59.058129Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:45:04.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Amy Burnett of OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:29.451Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2052207"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "JIT miscompilation in the JavaScript Engine: JIT component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16355",
    "datePublished": "2026-07-21T12:37:43.741Z",
    "dateReserved": "2026-07-20T21:55:59.129Z",
    "dateUpdated": "2026-07-22T19:18:29.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2026:49922 (CVE-2026-14899)

CVE-2026-14899 (GCVE-0-2026-14899)

CVE-2026-15718 (GCVE-0-2026-15718)

CVE-2026-15719 (GCVE-0-2026-15719)

CVE-2026-16349 (GCVE-0-2026-16349)

CVE-2026-16350 (GCVE-0-2026-16350)

CVE-2026-16351 (GCVE-0-2026-16351)

CVE-2026-16352 (GCVE-0-2026-16352)

CVE-2026-16353 (GCVE-0-2026-16353)

CVE-2026-16354 (GCVE-0-2026-16354)

CVE-2026-16355 (GCVE-0-2026-16355)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour