Description
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the DOM Workers component and allows privilege escalation by enabling code to run with authority beyond the normal isolation limits. The vulnerability is associated with CWE-266, CWE-269, and CWE-284. An attacker who can supply or persuade a user to load malicious content could create a worker that gains elevated access to browser resources, potentially compromising all browsing activity.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird, all versions released prior to version 153. The issue was fixed in Firefox 153 and Thunderbird 153.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity; however the EPSS score of less than 1% indicates a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves a malicious web page or add‑on that creates a Web Worker with elevated privileges, requiring the user to load permissions.

Generated by OpenCVE AI on August 4, 2026 at 05:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Firefox to version 153 or later
  • Update Thunderbird to version 153 or later
  • If an upgrade is not possible, disable the Workers API by setting dom.workers.enabled to false in about:config or via enterprise policy
  • Use a content‑security extension such as NoScript to block execution of untrusted workers

Generated by OpenCVE AI on August 4, 2026 at 05:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-266
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 24 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153. Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
References

Wed, 22 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-284
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153.
Title Privilege escalation in the DOM: Workers component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-24T20:16:53.217Z

Reserved: 2026-07-20T21:56:17.096Z

Link: CVE-2026-16365

cve-icon Vulnrichment

Updated: 2026-07-22T15:29:03.063Z

cve-icon NVD

Status : Modified

Published: 2026-07-21T13:17:05.037

Modified: 2026-07-24T21:16:43.503

Link: CVE-2026-16365

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-21T12:37:37Z

Links: CVE-2026-16365 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T06:00:05Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control