CVE-2026-16391: Firefox IndexedDB Information Disclosure

CVE-2026-16391 Overview

CVE-2026-16391 is an information disclosure vulnerability in the Storage: IndexedDB component of Mozilla Firefox and Thunderbird. The flaw allows a remote attacker to access sensitive data stored in the browser without user interaction or authentication. Mozilla addressed the issue in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
A network-based attacker can read sensitive data stored in IndexedDB across origin boundaries, exposing user credentials, session tokens, and application state without any user interaction.

Affected Products

Mozilla Firefox versions prior to 153
Mozilla Firefox ESR versions prior to 140.13
Mozilla Thunderbird versions prior to 153 and prior to 140.13

Discovery Timeline

2026-07-21 - CVE-2026-16391 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16391

Vulnerability Analysis

The vulnerability resides in the IndexedDB storage subsystem of Firefox and Thunderbird. IndexedDB is a client-side database API that allows web applications to store structured data, including files and blobs, within the browser. The component fails to properly enforce isolation boundaries, permitting unauthorized read access to stored records. An attacker hosting a malicious web page can trigger the flaw when a victim visits the page. No privileges or user interaction beyond page load are required for exploitation.

Root Cause

The root cause is improper access control within the IndexedDB implementation, mapped to [CWE-200]. Storage components must enforce same-origin policy checks on every read and write operation. In the affected versions, the checks are insufficient, allowing data intended for one origin to be exposed to another context. Mozilla's advisories MFSA-2026-68, MFSA-2026-70, MFSA-2026-71, and MFSA-2026-72 describe the corrective changes.

Attack Vector

Exploitation occurs over the network through a crafted web page or, in the case of Thunderbird, remote content rendered by the client. When the victim's browser processes the attacker-controlled content, the IndexedDB component leaks confidential data that should be restricted to other origins. Because integrity and availability are not affected, the impact is limited to data confidentiality. Refer to the Mozilla Bug Report #2044536 for technical details.

Detection Methods for CVE-2026-16391

Indicators of Compromise

Outbound HTTPS connections from Firefox or Thunderbird processes to unfamiliar domains immediately after page loads containing embedded IndexedDB scripts.
Browser telemetry showing IndexedDB open() and get() calls originating from unexpected cross-origin frames.
Access log entries on internal web applications indicating session tokens replayed from unrelated source addresses.

Detection Strategies

Inventory Firefox and Thunderbird versions across managed endpoints and flag hosts running builds earlier than Firefox 153, ESR 140.13, or Thunderbird 140.13.
Deploy network monitoring rules to identify data exfiltration patterns from browser processes to non-corporate destinations.
Correlate browser process activity with unusual authentication anomalies on downstream web applications.

Monitoring Recommendations

Enable endpoint telemetry that records browser child-process behavior and outbound connection metadata.
Track Mozilla security advisory feeds (MFSA-2026-68, MFSA-2026-70, MFSA-2026-71, MFSA-2026-72) for related follow-up fixes.
Monitor identity provider logs for session tokens used from geolocations or devices inconsistent with the legitimate user.

How to Mitigate CVE-2026-16391

Immediate Actions Required

Upgrade Firefox to version 153 or later on all managed endpoints.
Upgrade Firefox ESR to 140.13 or later where extended support builds are used.
Upgrade Thunderbird to version 153 or Thunderbird ESR 140.13 or later.
Force-close and restart browser sessions after patching to ensure the updated binary is active.

Patch Information

Mozilla released fixes in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. Details are documented in Mozilla Security Advisory MFSA-2026-68, MFSA-2026-70, MFSA-2026-71, and MFSA-2026-72.

Workarounds

Disable IndexedDB storage in Thunderbird by blocking remote content in messages until the client is updated.
Restrict browser usage to trusted sites through enterprise policy or web filtering while patches are deployed.
Rotate credentials and session tokens for high-value web applications accessed from unpatched browsers.

bash

# Verify Firefox version on Linux endpoints
firefox --version

# Enterprise policy example (policies.json) to enforce update channel
{
  "policies": {
    "DisableAppUpdate": false,
    "AppUpdateURL": "https://aus5.mozilla.org/update/"
  }
}