CVE-2026-16367

CRITICAL10.0Memory safety

JSON export Create alert

Description

Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected products

References

MISChttps://bugzilla.mozilla.org/show_bug.cgi?id=2050627
VENDOR_ADVISORYhttps://www.mozilla.org/security/advisories/mfsa2026-68/
VENDOR_ADVISORYhttps://www.mozilla.org/security/advisories/mfsa2026-71/

Updated 13m ago · 8 sources