CVE-2026-16397

Analyzed Analyzed - Analysis Complete

Clickjacking in Firefox for Android WebExtensions

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: Mozilla Corporation

Description

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-10

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16397

EUVD

EUVD-2026-46235

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 153.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

Executive Summary

This is a clickjacking vulnerability in Firefox for Android's WebExtensions component. Clickjacking occurs when an attacker tricks a user into clicking something different from what the user perceives, potentially allowing unauthorized actions.

Detection Guidance

This vulnerability is specific to Firefox for Android and involves clickjacking in WebExtensions. Detection requires checking the Firefox version on Android devices. If the version is below 153, the system is vulnerable. No direct network commands detect this, but you can verify the app version via device settings or ADB.

Impact Analysis

An attacker could exploit this to trick users into performing unintended actions on websites or extensions, such as enabling malicious extensions or granting permissions without their knowledge.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a clickjacking issue in Firefox for Android's WebExtensions component. Compliance implications would depend on how the vulnerability is exploited in a specific environment.

Mitigation Strategies

Update Firefox for Android to version 153 or later to address the clickjacking vulnerability in the WebExtensions component.

Hi! I’m here to help you understand CVE-2026-16397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70