Mozilla Firefox CVE-2026-16372

Exploitation targets the Firefox DOM Content Processes component on any version before 153 and, consistent with a content-process privilege-escalation class, most realistically requires the victim to load attacker-controlled web content in the browser and the attacker to have (or chain) execution inside the sandboxed content process before escalating privileges - meaning it is typically a second-stage/chained primitive rather than a standalone one-shot remote exploit. The published vector (AV:N/AC:L/PR:N/UI:N) asserts no authentication and no user interaction, but this contradicts the vulnerability type; treat UI-required and non-trivial complexity as the limiting factors and verify with Mozilla. Limiting factors: affects only Firefox versions prior to 153, and default auto-update reduces the exposed population quickly.

The signals here conflict and warrant caution. The NVD-style vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a 9.8 'critical' score implying trivial remote unauthenticated exploitation, but this is inconsistent with the vulnerability class: a browser content-process privilege escalation realistically requires the victim to render attacker-controlled web content (UI:R) and typically requires the attacker to already achieve code execution within the sandbox before escalating, so the true attack complexity is likely higher and UI is likely required - verify with Mozilla. Countering the high CVSS, the EPSS probability is only 0.14% (4th percentile), there is no CISA KEV listing, and no public POC is referenced, so real-world exploitation risk is currently low-to-moderate rather than the emergency implied by the raw score. Given Firefox's ubiquity, however, patching should still be prioritized because a working sandbox-escape chain would have broad impact.

A victim using a pre-153 version of Firefox visits an attacker-controlled or compromised web page, whose malicious content runs inside the sandboxed content process and then abuses the improper privilege management flaw to elevate out of that sandbox toward higher browser or system privileges. No public exploit code has been identified, and a practical attack would most likely be chained with a separate content-process code-execution primitive.