CVE-2026-16391 Mozilla CVE debrief

Who should care

Users of Firefox, Firefox ESR, Thunderbird, and Thunderbird should update to the latest versions to address this vulnerability. The vulnerability has a high CVSS score of 7.5, indicating a high severity. Security teams and operators of these products should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

A vulnerability in the Storage: IndexedDB component of Firefox, Firefox ESR, Thunderbird, and Thunderbird could allow for information disclosure. This issue was addressed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability has a high CVSS score of 7.5, indicating a high severity. Users of these products should update to the latest versions to address this vulnerability. Affected product deployments should be confirmed in managed environments, and owners should review official advisories or CVE records to validate affected scope, severity, and vendor guidance. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified.

Defensive priority

High priority due to the high CVSS score of 7.5 and the potential for information disclosure.

Recommended defensive actions

• Update Firefox to version 153 or later
• Update Firefox ESR to version 140.13 or later
• Update Thunderbird to version 153 or later
• Update Thunderbird to version 140.13 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide information on the vulnerability and its fixes. However, further analysis is needed to fully understand the impact and potential mitigations. The vulnerability affects the Storage: IndexedDB component, which could allow for information disclosure. Users of Firefox, Firefox ESR, Thunderbird, and Thunderbird should update to the latest versions to address this vulnerability. The CVE record was published on 2026-07-21T13:17:14.290Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. To verify the vulnerability, defenders should review the official advisory and CVE record.

Official resources