Description
Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability arises from a flaw in the Data Loss Prevention component of Mozilla products, allowing a local user to raise privileges within the application. The weakness involves improper enforcement of access controls, as classified by CWE‑269, and could enable execution of code or access to restricted data within the affected software.

Affected Systems

The issue affects Mozilla Firefox and Mozilla Thunderbird versions prior to 153. Specifically, any installation of Firefox 152 or earlier or Thunderbird 152 or earlier running the Data Loss Prevention feature is vulnerable. The bug was fixed in Firefox 153 and Thunderbird 153.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. It is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local, requiring user interaction to trigger the DLP component and exploit the flaw.

Generated by OpenCVE AI on August 4, 2026 at 05:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Firefox 153 or later and Thunderbird 153 or later.
  • Disable the Data Loss Prevention feature if you cannot upgrade immediately.
  • Monitor Mozilla security advisories for further updates.

Generated by OpenCVE AI on August 4, 2026 at 05:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 24 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153. Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
References

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153.
Title Privilege escalation in the Data Loss Prevention component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-24T20:13:26.310Z

Reserved: 2026-07-20T21:57:33.473Z

Link: CVE-2026-16401

cve-icon Vulnrichment

Updated: 2026-07-22T17:24:03.917Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-21T12:38:14Z

Links: CVE-2026-16401 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T05:45:03Z

Weaknesses
  • CWE-269

    Improper Privilege Management