Loading vulnerability…
Same-origin policy bypass in Firefox and Thunderbird DOM Navigation
CVE-2026-16349 is a same-origin policy bypass vulnerability in the DOM Navigation component of Mozilla Firefox and Thunderbird. Exploitation can bypass origin-based security boundaries, potentially permitting unauthorized cross-origin access or data exposure within the browser context. The vulnerability is fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses the same-origin policy and may expose data or allow unauthorized access across origins. Specific data types, the extent of access, and additional consequences are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is identified. Apply the appropriate product or distribution security update.
Patch, then assume compromise.
Upgrade to Firefox 153 or later, Firefox ESR 115.38 or later within that ESR branch, Firefox ESR 140.13 or later within that ESR branch, Thunderbird 153 or later, or Thunderbird 140.13 or later within that branch. On Debian 13 (trixie), install firefox-esr version 140.13.0esr-1~deb13u1 or later, or thunderbird version 1:140.13.0esr-2~deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.