CVE-2026-16358 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-16358 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-16358 is a site isolation vulnerability in Mozilla Firefox and Thunderbird involving the Graphics: WebRender component, which processes browser-rendered web content.

Technical Detail

The flaw affects site isolation controls associated with WebRender. A remote attacker could potentially trigger the issue by causing a user to process crafted web content in an affected Firefox or Thunderbird installation. Successful exploitation could undermine expected isolation between sites or content contexts; the available advisory information does not confirm remote code execution, privilege escalation, or a specific data-access outcome.

Exploitation Status

No known exploit has been reported, and CVE-2026-16358 is not listed in CISA's Known Exploited Vulnerabilities catalog as of July 28, 2026.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Prioritize updates for Mozilla Firefox and Thunderbird deployments. Apply Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, or Thunderbird 140.13, or later supported releases, as appropriate for the deployed product branch. No vendor-provided workaround or reliable detection indicator is currently confirmed; organizations should verify installed versions through endpoint software inventory and ensure browsers and email clients are configured to receive security updates promptly.