Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-16358: Firefox and Thunderbird WebRender may break site isolation
CVE-2026-16358 · published 3 months ago
Summary
The graphics component called WebRender in Firefox and Thunderbird can allow content from one website to escape the separation that normally keeps each site isolated, potentially exposing data from another site. This could let a malicious page see information it shouldn't. The issue is fixed in the latest releases, so install the newest version of Firefox or Thunderbird as soon as possible.
What to do
- Update debian firefox-esr to version 140.13.0esr-1~deb11u1.
- Update debian firefox-esr to version 140.13.0esr-1~deb12u1.
- Update debian firefox-esr to version 140.13.0esr-1~deb13u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | firefox-esr |
< 140.13.0esr-1~deb11u1 Fix: upgrade to 140.13.0esr-1~deb11u1
|
| Debian:12 | debian | firefox-esr |
< 140.13.0esr-1~deb12u1 Fix: upgrade to 140.13.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 140.13.0esr-1~deb13u1 Fix: upgrade to 140.13.0esr-1~deb13u1
|
| Debian:14 | debian | firefox-esr | All versions |
| Debian:11 | debian | thunderbird | All versions |
| Debian:12 | debian | thunderbird | All versions |
| Debian:13 | debian | thunderbird | All versions |
| Debian:14 | debian | thunderbird | All versions |
| – | mozilla | firefox |
< 115.38.0 < 153.0.0 >= 128.1.0, < 140.13.0 |
| – | mozilla | thunderbird |
< 140.13.0 >= 141.0, < 153.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
Site isolation issue in the Graphics: WebRender component
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2040119 Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2026-68/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-69/ Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-16358 Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-70/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-71/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-72/ Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-346Origin Validation Error
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen21 Jul 2026
Track software like this
Free during beta