Integer overflow in Firefox for Android and Mozilla Firefox - CVE-2026-16389

Vulnerability identifier: #VU139009

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-16389

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the Libraries component in NSS when processing input. A remote attacker can supply crafted input to cause a denial of service.

The advisory also reports incorrect boundary conditions in the same component.

Firefox for Android
Mozilla Firefox
Debian Linux
openEuler
Mozilla Thunderbird
nss
nss-debuginfo
nss-debugsource
nss-devel
nss-help
nss-softokn
nss-softokn-devel
nss-util
nss-util-devel
nss (Debian package)

Install security update from vendor's website.

Firefox for Android - update to 153.0
Mozilla Firefox - update to 153.0
Mozilla Thunderbird - update to 153.0
nss - update to 3.94.0-10
nss-debuginfo - update to 3.94.0-10
nss-debugsource - update to 3.94.0-10
nss-devel - update to 3.94.0-10
nss-help - update to 3.94.0-10
nss-softokn - update to 3.94.0-10
nss-softokn-devel - update to 3.94.0-10
nss-util - update to 3.94.0-10
nss-util-devel - update to 3.94.0-10
nss (Debian package) - update to 2:3.110-1+deb13u4

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2043887

• Multiple vulnerabilities in Mozilla Firefox
• Multiple vulnerabilities in Mozilla Thunderbird
• Debian update for nss
• openEuler update for nss