Loading vulnerability…
DOM Security Mitigation Bypass in Mozilla Firefox and Thunderbird
CVE-2026-16394 is a mitigation-bypass vulnerability in the DOM: Security component of Mozilla Firefox and Thunderbird. Successful exploitation allows an attacker to bypass security mitigations enforced by this component. The specific mitigation affected, vulnerable function, and underlying implementation flaw have not been identified. The vulnerability was fixed in Firefox 153 and Thunderbird 153.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses DOM security mitigations. The specific security boundary affected and any resulting confidentiality, integrity, or availability consequences are not established. Arbitrary code execution, sandbox escape, and information disclosure are not independently established for this vulnerability.
If you can’t patch tonight, do this now.
No separate workaround or temporary mitigation has been identified. Apply the fixed software versions.
Patch, then assume compromise.
Upgrade Firefox to version 153 or later and Thunderbird to version 153 or later. For distribution-managed installations, install the vendor security update containing the corresponding fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.