Skip to main content

Mozilla Firefox EUVDEUVD-2026-46215

| CVE-2026-16379 HIGH
Improper Privilege Management (CWE-269)
2026-07-21 mozilla GHSA-wh9f-q55j-mp9r
Privilege Escalation Red Hat Mozilla
High
Disputed · 8.8 Vendor: mozilla
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (mozilla) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
9.6 CRITICAL

Delivery is via malicious web content so UI:R; escaping the content-process sandbox to higher privilege is a scope change (S:C) with full C/I/A impact on the host.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
CRITICAL
qualitative
Red Hat
6.1 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Re-analysis Queued
Jul 24, 2026 - 21:22 vuln.today
cvss_changed
Severity Changed
Jul 24, 2026 - 21:22 NVD
CRITICAL HIGH
CVSS changed
Jul 24, 2026 - 21:22 NVD
9.8 (CRITICAL) 8.8 (HIGH)
Analysis Generated
Jul 22, 2026 - 19:39 vuln.today
CVSS changed
Jul 22, 2026 - 18:22 NVD
9.8 (CRITICAL)
CVE Published
Jul 21, 2026 - 12:37 cve.org
CRITICAL 9.8
CVE Published
Jul 21, 2026 - 12:37 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.

AnalysisAI

Privilege escalation in Mozilla Firefox's DOM Content Processes component allows an attacker who influences a sandboxed content process to break out of the renderer sandbox and gain elevated privileges on the host, affecting Firefox before 153 and Firefox ESR before 140.13. Mozilla assigns a critical CVSS of 9.8, though the 'content process' scope suggests the practical entry point is attacker-controlled web content rather than a fully unauthenticated network service. No public exploit is identified at time of analysis, and the EPSS exploitation probability is very low (0.15%, 5th percentile).

Technical ContextAI

Firefox uses a multi-process (Electrolysis) architecture in which untrusted web content is rendered inside sandboxed 'content processes' that hold minimal privileges, while a higher-trust parent/broker process mediates OS access. This flaw sits in the DOM Content Processes component and is classified CWE-269 (Improper Privilege Management), meaning a boundary that should confine the content process instead lets it acquire capabilities beyond its intended sandbox - effectively a sandbox-escape / privilege-escalation primitive. The affected product per the supplied CPE is cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* (all Firefox builds before the fixed versions), with the same issue tracked in the EU vulnerability database as EUVD-2026-46215.

RemediationAI

Vendor-released patch: upgrade to Firefox 153 or, for the extended-support channel, Firefox ESR 140.13. Apply the update through the browser's normal update mechanism or enterprise deployment tooling (ESR/policy-managed fleets should push the fixed ESR build), and confirm installed versions against Mozilla advisories mfsa2026-68 (https://www.mozilla.org/security/advisories/mfsa2026-68/) and mfsa2026-70 (https://www.mozilla.org/security/advisories/mfsa2026-70/). If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites and deploying strict content controls and web filtering to block untrusted or ad-served script where feasible - accepting the usability trade-off that some sites may break - since the practical trigger is loading attacker-influenced web content; there is no configuration toggle that disables the affected DOM content-process path without disabling normal browsing.

More in Mozilla

View all
CVE-2015-4495 HIGH POC
8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2013-0643 HIGH
8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2019-1405 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected

Share

EUVD-2026-46215 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy