CVE catalog
CVE-2026-16385
UBUNTU-
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.43% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "mozjs52",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"52.3.1-0ubuntu3",
"52.3.1-7fakesync1",
"52.8.1-0ubuntu0.18.04.1",
"52.9.1-0ubuntu0.18.04.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "mozjs38",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"38.8.0~repack1-0ubuntu1",
"38.8.0~repack1-0ubuntu3",
"38.8.0~repack1-0ubuntu4"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "mozjs68",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "20.04",
"versions": [
"68.5.0-1~fakesync",
"68.5.0-2~fakesync",
"68.6.0-1",
"68.6.0-1ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "mozjs52",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "20.04",
"versions": [
"52.9.1-1build1",
"52.9.1-1ubuntu3"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "mozjs102",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"102.11.0-0ubuntu0.22.04.1",
"102.12.0-0ubuntu0.22.04.1",
"102.13.0-0ubuntu0.22.04.1",
"102.15.1-0ubuntu0.22.04.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "mozjs78",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"78.13.0-1",
"78.15.0-2",
"78.15.0-4ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "mozjs91",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"91.5.1-0ubuntu1",
"91.6.0-1",
"91.6.0-2",
"91.7.0-2",
"91.10.0-0ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "thunderbird",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"1:91.1.2+build1-0ubuntu1",
"1:91.3.0+build2-0ubuntu1",
"1:91.3.1+build1-0ubuntu1",
"1:91.3.2+build1-0ubuntu1",
"1:91.4.0+build1.1-0ubuntu1",
"1:91.4.0+build2-0ubuntu1",
"1:91.5.0+build1-0ubuntu1",
"1:91.5.1+build1-0ubuntu1",
"1:91.6.1+build1-0ubuntu1",
"1:91.7.0+build1-0ubuntu1",
"1:91.7.0+build2-0ubuntu1",
"1:91.8.0+build2-0ubuntu1",
"1:91.9.1+build1-0ubuntu0.22.04.1",
"1:91.11.0+build2-0ubuntu0.22.04.1",
"1:102.2.2+build1-0ubuntu0.22.04.1",
"1:102.4.2+build2-0ubuntu0.22.04.1",
"1:102.7.1+build2-0ubuntu0.22.04.1",
"1:102.8.0+build2-0ubuntu0.22.04.1",
"1:102.9.0+build1-0ubuntu0.22.04.1",
"1:102.10.0+build2-0ubuntu0.22.04.1",
"1:102.11.0+build1-0ubuntu0.22.04.1",
"1:102.13.0+build1-0ubuntu0.22.04.1",
"1:102.15.0+build1-0ubuntu0.22.04.1",
"1:102.15.1+build1-0ubuntu0.22.04.1",
"1:115.3.1+build1-0ubuntu0.22.04.2",
"1:115.4.1+build1-0ubuntu0.22.04.1",
"1:115.5.0+build1-0ubuntu0.22.04.1",
"1:115.6.0+build2-0ubuntu0.22.04.1",
"1:115.8.1+build1-0ubuntu0.22.04.1",
"1:115.9.0+build1-0ubuntu0.22.04.1",
"1:115.10.1+build1-0ubuntu0.22.04.1",
"1:115.11.0+build2-0ubuntu0.22.04.1",
"1:115.12.0+build3-0ubuntu0.22.04.1",
"1:115.13.0+build5-0ubuntu0.22.04.1",
"1:115.15.0+build1-0ubuntu0.22.04.1",
"1:115.16.0+build2-0ubuntu0.22.04.1",
"1:115.18.0+build1-0ubuntu0.22.04.1",
"1:128.12.0+build1-0ubuntu0.22.04.1",
"1:140.7.1+build1-0ubuntu0.22.04.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "mozjs102",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "24.04",
"versions": [
"102.15.1-1",
"102.15.1-3ubuntu2"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "mozjs115",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "24.04",
"versions": [
"115.3.0-0ubuntu1",
"115.4.0-2",
"115.5.0-1",
"115.6.0-1",
"115.7.0-4",
"115.8.0-1",
"115.9.0-1",
"115.9.0-1build1",
"115.10.0-1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-16385"
},
{
"name": "firefox",
"ranges": [
{
"fixed": "153.0.0",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "153.0.0",
"provider_record_id": "NVD-CVE-2026-16385"
},
{
"name": "thunderbird",
"ranges": [
{
"fixed": "153.0",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "153.0",
"provider_record_id": "NVD-CVE-2026-16385"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed:
References
- [https://bugzilla.mozilla.org/show_bug.cgi?id=2041912]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11358-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-16385]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-16385]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16385.json]
- [https://www.mozilla.org/security/advisories/mfsa2026-68/]
- [https://www.mozilla.org/security/advisories/mfsa2026-71/]
[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]