Mozilla Firefox CVE-2026-16365

The vulnerable code path is the DOM: Workers component, so exploitation requires the victim's Firefox (pre-version 153) to process attacker-influenced content that exercises Web Worker functionality - i.e., the attacker needs the target to load malicious or compromised web content that spawns/drives a Worker. The CVSS vector states UI:N and PR:N (unauthenticated, no interaction), but for a browser-content flaw the practical limiting factor is that the user must navigate to or render attacker-controlled content; this apparent tension between the vector and the browser threat model should be confirmed against MFSA2026-68. Exploitation is further limited to affected Firefox versions below 153 and is neutralized entirely once the browser auto-updates.

The signals conflict and warrant scrutiny. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which models fully remote, unauthenticated, no-interaction network exploitation - but a browser privilege-escalation bug realistically requires the victim to load attacker-controlled web content, so the UI:N/PR:N framing likely overstates real-world reachability; verify the interaction requirement with Mozilla. Countervailing the high CVSS, EPSS is only 0.14% (4th percentile), the CVE is NOT on CISA KEV, and no POC is referenced, so this is a high-severity-by-vector but low-observed-risk issue rather than an actively exploited emergency. Mozilla being the sole reporter and the presence of a fixed release suggest responsible disclosure rather than in-the-wild discovery. Net: patch on the normal browser-update cadence; this is not signaling active exploitation.

An attacker hosts or injects malicious JavaScript on a web page and lures a Firefox user (pre-153) to visit it; the script abuses the DOM Workers privilege-management flaw to escalate privileges within the browser, potentially breaking out of the intended web-content privilege boundary. Given AC:L, exploitation is not gated by complex timing or configuration once the bug is triggerable, but no public POC or exploit code has been identified at time of analysis.