CVE-2026-16366

Status: ModifiedHigh (8.8)—

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base score: 8.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.27%
Percentile among all scored CVEs: 17
Score date: 10/4/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1203 Exploitation for Client Executionexecution85 %
Primary impactT1068 Exploitation for Privilege Escalationprivilege escalation80 %

Escala de privilegios en DOM Navigation de Firefox/Thunderbird con UI:R. Vector CVSS requiere interacción del usuario (UI:R), priorizando T1203 (explotación en cliente). El impacto es T1068 (escalada de privilegios local) confirmado por la descripción de privilegios en el componente DOM.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Application Isolation and Sandboxing Exploit Protection Update Software Threat Intelligence Program Execution Prevention

Affected technologies (2)

Mozilla — Firefox Mozilla — Thunderbird

CWEs

CWE-269

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-16366",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-16366",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-24T03:55:29.169175Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "Mozilla",
          "product": "Firefox",
          "versions": [
            {
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm",
              "lessThanOrEqual": "*"
            }
          ]
        },
        {
          "vendor": "Mozilla",
          "product": "Thunderbird",
          "versions": [
            {
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-21T13:17:05.140",
  "references": [
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2049181",
      "tags": [
        "Permissions Required"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."
    }
  ],
  "lastModified": "2026-07-24T21:16:43.670",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD42740F-7A0F-4332-BFF3-46E0E8F37752",
              "versionEndExcluding": "153.0.0"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "424BA860-1123-482C-9168-4A97E2EE0394",
              "versionEndExcluding": "153.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}