| CVE-2026-16384 | HOCH7.5 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16383 | KRITISCH9.8 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16382 | KRITISCH9.8 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16381 | KRITISCH9.1 | Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16380 | KRITISCH9.1 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16379 | HOCH8.8 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16378 | HOCH7.5 | Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16377 | KRITISCH9.8 | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16376 | HOCH7.5 | Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16375 | KRITISCH9.8 | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16374 | HOCH7.5 | Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16372 | HOCH8.8 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16371 | HOCH8.8 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15. | 21/07/2026 |
| CVE-2026-16370 | KRITISCH9.1 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16369 | KRITISCH9.8 | Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16368 | KRITISCH9.8 | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | 21/07/2026 |
| CVE-2026-16367 | KRITISCH10.0 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16366 | HOCH8.8 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |
| CVE-2026-16365 | HOCH8.8 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15. | 21/07/2026 |
| CVE-2026-16364 | KRITISCH9.1 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | 21/07/2026 |