WebSocket Information Disclosure in Firefox and Firefox ESR
CVE-2026-16405

7.5HIGH

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
21 July 2026

What is CVE-2026-16405?

A vulnerability affecting the Networking: WebSockets component allows unauthorized access to sensitive information within the affected versions of Firefox and Firefox ESR. Attackers could exploit this flaw to extract private data while WebSocket connections are established. This issue has been addressed in Firefox version 153 and Firefox ESR version 140.13, which users are advised to upgrade to for enhanced security.

Affected Version(s)

Firefox 140.13

Firefox 153

Thunderbird 140.13

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2036591
https://www.mozilla.org/security/advisories/mfsa2026-68/
https://www.mozilla.org/security/advisories/mfsa2026-70/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqoub Aldurayhim
.