Paper/Archive/CVE-2026-16406

CVE-2026-16406

Mozilla Firefox — Mitigation bypass in the Networking component

EPSS 0.4%CVSS 9.1

critical.is priorityof 100

35

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 37.6.376 × 207.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Affected

ProductAffectedFixed inSource

Firefoxsee advisory153CNA

Thunderbirdsee advisory153CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2040382 refmozilla.org/security/advisories/mfsa2026-68 refmozilla.org/security/advisories/mfsa2026-71