CVE-2026-16381

Analyzed Analyzed - Analysis Complete

Same-origin policy bypass in Firefox

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Mozilla Corporation

Description

Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-10

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16381

EUVD

EUVD-2026-46218

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 153.0.0 (exc)
mozilla	firefox	to 140.13.0 (exc)
mozilla	thunderbird	to 140.13.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a same-origin policy bypass in the Networking: DNS component of Firefox and Firefox ESR. The same-origin policy is a security feature that prevents scripts from one website from accessing data from another website unless they share the same origin. A bypass means an attacker could potentially access sensitive data across different origins.

Detection Guidance

This vulnerability is specific to Firefox and Firefox ESR versions before 153 and 140.13 respectively. Detection involves checking installed versions of these browsers. Use commands like 'firefox --version' or 'firefox-esr --version' to verify if your system is affected.

Impact Analysis

If exploited, this vulnerability could allow an attacker to bypass security restrictions and access data from different websites or applications that should be isolated. This may lead to unauthorized access to sensitive information such as login credentials, personal data, or financial details.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected Firefox versions may face legal penalties, reputational damage, and increased scrutiny from regulators.

Mitigation Strategies

Update Firefox to version 153 or later and Firefox ESR to version 140.13 or later to address the same-origin policy bypass in the Networking: DNS component.

Hi! I’m here to help you understand CVE-2026-16381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70