Mozilla Firefox CVE-2026-16399

Exploitation requires the victim to load attacker-controlled web content in an unpatched Firefox (before version 153) and specifically exercises the DOM: Navigation code path to break the site-isolation/Fission origin boundary; the payoff is limited to reading cross-origin data (C:H, I:N, A:N). Limiting factors: the attack targets Firefox only (not other browsers), needs the user to actually navigate to or render the malicious content, and is closed entirely once Firefox 153 is installed. While CVSS marks UI:N, in practice a browser rendering hostile content is the delivery vector, so realistic exploitation is gated on getting the victim to visit an attacker page rather than any pre-existing authentication or privileged access.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) reflects a network-reachable, unauthenticated, low-complexity issue whose entire weight is confidentiality - there is no integrity or availability impact. However, as a browser web-content bug it realistically requires the victim to load attacker-controlled content, a limiting factor Mozilla's UI:N scoring does not capture; treat practical severity as somewhat lower than raw 7.5 for internet-facing exposure. The signals are consistent and point to modest urgency: EPSS is 0.13% (3rd percentile), the CVE is not on CISA KEV, and no POC is referenced, so there is no evidence of active exploitation. Net assessment: a legitimate confidentiality issue worth patching in the normal browser-update cycle, but not an emergency relative to actively exploited browser zero-days.

An attacker hosts a malicious web page and lures a Firefox user (pre-153) to visit it via a phishing link or malvertising frame. The page triggers the flawed navigation path to defeat site isolation and read cross-origin content - such as data from another site the victim is logged into - exfiltrating it back to the attacker. No public exploit code is identified at time of analysis.