GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-16397 (GCVE-0-2026-16397)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:38 – Updated: 2026-07-21 19:29
VLAI
Title
Clickjacking issue in the WebExtensions component in Firefox for Android
Summary
Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 19:29 UTC
CWE
  • CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
Impacted products
Vendor Product Version CPE status
Mozilla Firefox Unaffected: 153 , ≤ * (rpm)
guessed Create a notification for this product.
Credits
Hafiizh
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T19:29:06.633055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1021",
                "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T19:29:51.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Hafiizh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153."
            }
          ],
          "value": "Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T12:38:10.683Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2047608"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        }
      ],
      "title": "Clickjacking issue in the WebExtensions component in Firefox for Android"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16397",
    "datePublished": "2026-07-21T12:38:10.683Z",
    "dateReserved": "2026-07-20T21:57:25.987Z",
    "dateUpdated": "2026-07-21T19:29:51.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-16397",
      "date": "2026-09-04",
      "epss": "0.00174",
      "percentile": "0.06958"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-16397\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2026-07-21T13:17:14.977\",\"lastModified\":\"2026-07-22T18:29:21.307\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.\"}],\"affected\":[{\"source\":\"security@mozilla.org\",\"affectedData\":[{\"vendor\":\"Mozilla\",\"product\":\"Firefox\",\"versions\":[{\"version\":\"153\",\"lessThanOrEqual\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-21T19:29:06.633055Z\",\"id\":\"CVE-2026-16397\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1021\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*\",\"versionEndExcluding\":\"153.0.0\",\"matchCriteriaId\":\"5DB4AF59-87C2-4FC4-896D-02879D6F8E6B\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=2047608\",\"source\":\"security@mozilla.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2026-68/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-27T09:25:02+00:00",
      "cve": "CVE-2026-16397",
      "id": "CVE-2026-16397",
      "initial_release_date": "2026-07-21T12:38:10.683000+00:00",
      "product_status:known_not_affected": "12",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "firefox: Clickjacking issue in the WebExtensions component in Firefox for Android",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16397.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-02T11:52:09Z",
      "cve": "CVE-2026-16397",
      "id": "CVE-2026-16397",
      "initial_release_date": "2026-07-22T00:09:46Z",
      "product_status:first_fixed": "374",
      "product_status:known_affected": "48",
      "product_status:recommended": "30",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-16397",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-16397.json",
      "version": "11"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-16397\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-21T19:29:06.633055Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1021\", \"description\": \"CWE-1021 Improper Restriction of Rendered UI Layers or Frames\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-21T19:28:58.549Z\"}}], \"cna\": {\"title\": \"Clickjacking issue in the WebExtensions component in Firefox for Android\", \"credits\": [{\"lang\": \"en\", \"value\": \"Hafiizh\"}], \"affected\": [{\"vendor\": \"Mozilla\", \"product\": \"Firefox\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"153\", \"versionType\": \"rpm\", \"lessThanOrEqual\": \"*\"}]}], \"references\": [{\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=2047608\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2026-68/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"shortName\": \"mozilla\", \"dateUpdated\": \"2026-07-21T12:38:10.683Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-16397\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-21T19:29:51.336Z\", \"dateReserved\": \"2026-07-20T21:57:25.987Z\", \"assignerOrgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"datePublished\": \"2026-07-21T12:38:10.683Z\", \"assignerShortName\": \"mozilla\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}