Mozilla Products Multiple Vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities have been identified in Mozilla products.

Who is affected

All deployments of affected Mozilla products are at risk.

Urgency

Remediation is important as these vulnerabilities may be exploited later.

Action

Update to the latest versions of affected Mozilla products.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

HKCERT Security Bulletins (HK · national-cert · site)

Severity

unknown

Published

2026-07-22

Exploitation

Not in CISA KEV at last sync

Original advisory: https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities_20260722

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-157180.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
• Low exploitation riskCVE-2026-157190.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
• Low exploitation riskCVE-2026-163490.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
• Low exploitation riskCVE-2026-163500.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
• Low exploitation riskCVE-2026-163510.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
• Low exploitation riskCVE-2026-163520.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
• Low exploitation riskCVE-2026-163530.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
• Low exploitation riskCVE-2026-163540.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
• Low exploitation riskCVE-2026-163550.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
• Low exploitation riskCVE-2026-163560.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.

Referenced CVEs

+12 more CVEs referenced in this advisory.

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• high[NEW] [high] Mozilla Firefox and Firefox ESR: Multiple vulnerabilitiescert-bund
• medium[NEW] [medium] Mozilla Firefox: Multiple vulnerabilities allow unspecified attackcert-bund
• unknownDSA-6403-1 nss - security updatedebian
• unknownMultiple vulnerabilities in Mozilla Thunderbird (July 23, 2026)cert-fr-avis
• unknownDSA-6394-1 firefox-esr - security updatedebian
• unknownMultiple vulnerabilities in Mozilla products (July 22, 2026)cert-fr-avis
• criticalCVE-2026-16406: Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and…nvd
• highCVE-2026-16405: Information disclosure in the Networking: WebSockets component. This vulnerability was fixed i…nvd
• highCVE-2026-16404: Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.nvd
• mediumCVE-2026-16403: Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and T…nvd
• criticalCVE-2026-16402: Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox …nvd
• highCVE-2026-16401: Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Fi…nvd

More from HKCERT Security Bulletins

• unknownCisco Secure Firewall Management Center Software Information Disclosure Vulnerability2026-07-30
• unknownGoogle Chrome Multiple Vulnerabilities2026-07-30
• unknownIBM WebSphere Products Multiple Vulnerabilities2026-07-30
• unknownNode.js Multiple Vulnerabilities2026-07-30
• unknownXen Multiple Vulnerabilities2026-07-30