Cyber Resilience

CVE-2026-16394

Mozilla Firefox ≤ 153.0.0

Published
21 July 2026
Modified
22 July 2026
Patch / advisory
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0025 17th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-16394 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability in Mozilla Firefox. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-18 (Mobile Code) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Mitigation bypass in browser DOM security component directly enables client-side exploitation (T1203) and drive-by compromise (T1189) via protection mechanism failure (CWE-693).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-6427Same product: Mozilla Firefox
CVE-2025-54143Same product: Mozilla Firefox
CVE-2026-10702Same product: Mozilla Firefox
CVE-2026-16408Same product: Mozilla Firefox
CVE-2026-16412Same product: Mozilla Firefox
CVE-2026-3847Same product: Mozilla Firefox
CVE-2026-4691Same product: Mozilla Firefox
CVE-2026-4702Same product: Mozilla Firefox
CVE-2026-8962Same product: Mozilla Firefox
CVE-2026-4723Same product: Mozilla Firefox

Affected Assets

mozilla
firefox
≤ 153.0.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-18 Mobile Code
  • AC-4 Information Flow Enforcement
  • SI-16 Memory Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 6 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.3.3
  • V6.6.3
  • V10.2.2

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly restricts and validates mobile code (scripts) execution in the DOM, addressing the root cause of the security-component bypass.

prevent

Enforces information-flow rules between origins and contexts inside the DOM, preventing the exact class of mitigation bypass described.

prevent

Applies memory and process protections that raise the bar against exploitation of DOM security-component flaws.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Enforcing authentication directly implements a core protection mechanism whose absence or misuse is the CWE.

PR.AA-05 mostly match
prevents

Defining and enforcing access authorizations is a protection mechanism; proper use prevents the CWE.

PR.DS-01 mostly match
prevents

Cryptographic and integrity controls are protection mechanisms whose correct deployment mitigates the CWE.

PR.DS-02 mostly match
prevents

Encryption and integrity protections for transit are explicit protection mechanisms.

PR.IR-01 mostly match
prevents

Logical network protections are protection mechanisms whose failure matches the CWE.

PR.PS-01 partial match
prevents

Hardened configuration baselines ensure protection mechanisms are correctly applied and maintained.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.

mitigates

Hardening devices, disabling vulnerable protocols, and maintaining accurate network diagrams reduce the likelihood that a protection mechanism is misconfigured or left in a weak state.

none

Requiring defined escalation paths, crisis activation criteria, and coordination procedures strengthens the overall protection mechanism so that a single control failure is less likely to leave the organization exposed.

none

By requiring a documented categorization and decision process for security events, the control ensures that protection mechanisms are not bypassed or ignored when anomalies occur.

none

Identifying and remediating control weaknesses that contributed to an incident reduces the likelihood that protection mechanisms will fail again.

none

Post-incident analysis that feeds updated risk assessments and additional controls directly reduces the chance that previously exploited weaknesses will recur.

References