CVE-2026-16358

Analyzed Analyzed - Analysis Complete

Site Isolation Bypass in Firefox via WebRender

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Mozilla Corporation

Description

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16358

EUVD

EUVD-2026-46216

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 153.0.0 (exc)
mozilla	firefox	to 115.38.0 (exc)
mozilla	firefox	From 128.1.0 (inc) to 140.13.0 (exc)
mozilla	thunderbird	to 140.13.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This is a site isolation issue in Firefox's Graphics: WebRender component. Site isolation is a security feature that separates content from different websites to prevent malicious actions like data theft or cross-site scripting. A flaw in this component could allow an attacker to bypass these protections and access sensitive data across different sites.

Detection Guidance

This vulnerability is specific to Firefox versions before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13. Detection involves checking installed Firefox versions. On Linux, run 'firefox --version' or 'dpkg -l | grep firefox' for Debian-based systems. On Windows, check 'Programs and Features' or run 'wmic product get name,version' in Command Prompt. Compare versions against the fixed releases.

Impact Analysis

If exploited, this vulnerability could allow an attacker to access data from other websites you are visiting, potentially stealing sensitive information like login credentials, personal details, or financial data. It could also enable cross-site scripting attacks, leading to unauthorized actions on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using affected Firefox versions may face compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Update Firefox to version 153 or later, Firefox ESR 115.38 or later, or Firefox ESR 140.13 or later to address the Site isolation issue in Graphics: WebRender.

Hi! I’m here to help you understand CVE-2026-16358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70