CVE-2026-16375 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-16375 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-16375 is a site isolation vulnerability in the HTTP networking component of Mozilla Firefox and Mozilla Thunderbird that could allow web content to affect isolation boundaries.

Technical Detail

The issue involves site isolation handling within HTTP networking. Mozilla has not published technical details describing the specific triggering conditions, affected isolation boundary, or post-exploitation behavior. If exploited, the flaw could undermine browser-enforced separation between sites or content contexts; the available information does not confirm remote code execution, privilege escalation, or authentication bypass.

Exploitation Status

No known exploit has been reported, and CVE-2026-16375 is not listed in CISA's Known Exploited Vulnerabilities catalog as of July 28, 2026.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Prioritize updates to Firefox 153 or later, Firefox ESR 140.13 or later, Thunderbird 153 or later, and Thunderbird 140.13 or later. Organizations should verify that managed endpoints have received the applicable release-channel update and should remove or restrict use of unsupported browser and mail-client versions. No vendor-supported workaround or reliable detection signal has been published; monitor Mozilla security advisories and endpoint software inventory for systems that remain below the fixed versions.