CVE-2026-16366: Mozilla Firefox privilege escalation in DOM Navigation component

Executive brief

A privilege escalation vulnerability was identified in the Mozilla Firefox web browser's navigation component. This flaw could allow a malicious website to gain higher levels of access than intended within the browser environment, potentially leading to unauthorized actions or data access. Users should update to Firefox 153 or later to mitigate this risk.

Technical details

A privilege escalation vulnerability exists in the DOM: Navigation component of Mozilla Firefox. The flaw allows for an elevation of privilege within the browser's internal security model. While specific root cause details are restricted in the associated Bugzilla report, the vulnerability is categorized as high impact by Mozilla. An attacker could potentially exploit this by enticing a user to visit a specially crafted webpage. The issue is resolved in Firefox version 153.

Affected products

• Mozilla Firefox Before 153

Timeline

• 2026-07-21: disclosed
• 2026-07-21: patched

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=2049181
• https://www.mozilla.org/security/advisories/mfsa2026-68/