CVE-2026-16391: 
NixOS vulnerability analysis and mitigation

CVE-2026-16391 is an information disclosure vulnerability in the Storage: IndexedDB component of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. Discovered and reported by Tomoya Nakanishi, it was publicly disclosed on July 21, 2026, as part of Mozilla's coordinated security advisory release. Affected versions include Firefox prior to 153, Firefox ESR prior to 140.13, Thunderbird prior to 153, and Thunderbird ESR prior to 140.13. It carries a CVSS v3.1 base score of 7.5 (High) (Mozilla Advisory, Mozilla Advisory).

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and resides in the browser's IndexedDB storage subsystem (Mozilla Advisory). IndexedDB is a client-side storage API used by web applications to persist structured data; a flaw in its implementation allows unauthorized access to data that should be protected by origin isolation or access controls. The attack vector is network-based, requires no privileges and no user interaction, making it automatable. The specific internal bug is tracked as Mozilla Bug 2044536, though the bug report is access-restricted (Mozilla Advisory).

Successful exploitation results in a high confidentiality impact, with no effect on integrity or availability. An attacker could potentially read sensitive data stored in a victim's IndexedDB databases — which may include authentication tokens, cached credentials, application state, or other private user data — without authorization. The scope is limited to the affected browser instance, but the network-accessible, no-interaction nature of the flaw means it could be triggered by a malicious web page visited by the user (Mozilla Advisory, Mozilla Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-16391 as of the time of disclosure. The NVD SSVC assessment confirms exploitation status as "none" and the vulnerability is automatable with partial technical impact. The EPSS score is approximately 0.0015 (0.15%), indicating a low probability of exploitation in the near term. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Mozilla Advisory).

Mozilla has released patches addressing this vulnerability in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird ESR 140.13. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading to a patched release is the only recommended remediation (Mozilla Advisory, Mozilla Advisory). Linux distribution vendors including Red Hat, SUSE, and openSUSE have also issued downstream security updates addressing this CVE.

The vulnerability was disclosed as part of a large batch of Mozilla security fixes on July 21, 2026, which attracted broad coverage from Linux distribution security teams (Red Hat, SUSE, openSUSE, Slackware, AlmaLinux, Rocky Linux) who issued downstream advisories. Vulnerability tracking platforms including Tenable (Nessus), Qualys, Kaspersky, and VulDB catalogued the issue promptly. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-16391 has been identified, as attention was largely focused on the more critical CVEs in the same advisory batch.