Improper Restriction of Rendered UI Layers or Frames in Firefox for Android and Mozilla Firefox - CVE-2026-16397
Published: July 22, 2026
Vulnerability identifier: #VU139014
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-16397
CWE-ID: CWE-1021
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform clickjacking attacks.
The vulnerability exists due to improper user interface control in the WebExtensions component when rendering extension user interface elements. A remote attacker can present crafted interface elements to perform clickjacking attacks.
This issue is specific to Firefox for Android.
Affected software
Firefox for Android
Mozilla Firefox
Mozilla Firefox
How to mitigate CVE-2026-16397
Install security update from vendor's website.
Firefox for Android - update to 153.0
Mozilla Firefox - update to 153.0
Mozilla Firefox - update to 153.0