Mozilla Firefox CVE-2026-16405

The vulnerable code path is the Networking: WebSockets component, so exploitation requires the victim's Firefox to establish a WebSocket (ws:// or wss://) connection - typically by loading attacker-controlled or attacker-influenced web content that initiates the handshake. The CVSS vector marks PR:N and UI:N (no privileges, no explicit user interaction beyond normal browsing), and the affected population is limited to Firefox versions before 153 and ESR before 140.13; patched builds are not exploitable. The practical limiting factor is that the attacker must get the target to open a page that speaks WebSockets - a purely server-initiated attack against an idle browser is unlikely - and impact is confined to information disclosure (C:H) with no integrity or availability effect.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields 7.5 (High) and signals an attractive profile: network reachable, low complexity, no privileges, no user interaction, with high confidentiality impact and no integrity/availability effect - a pure data-disclosure bug. Because the impact is confidentiality-only, this is not a code-execution or takeover primitive, which tempers real-world priority relative to a same-scored RCE. No EPSS score was supplied, the issue is not in CISA KEV (no confirmed active exploitation), and no POC is referenced, so exploitation is theoretical at this time. One caveat: the AV:N/UI:N vector implies a fully server-driven attack, yet real WebSocket exploitation typically requires the victim to visit or keep open an attacker-influenced page - verify the precise trigger with Mozilla's advisory before treating it as zero-interaction. Overall this is a genuine patch-promptly item due to Firefox's ubiquity, but not an emergency in the absence of exploitation signals.

An attacker hosts or compromises a web page that opens a WebSocket connection and induces a victim using an unpatched Firefox (pre-153 / pre-ESR-140.13) to load it; the WebSocket flaw then leaks confidential data - such as cross-origin content or uninitialized memory - back to the attacker's server. Given AV:N/AC:L/PR:N, no authentication or elevated privileges are needed, but no public POC is currently known, so any exploitation would require original development.