CVE-2026-16351

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

A use-after-free vulnerability in the DOM: Navigation component allows sandbox escape. The flaw was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Risk Assessment

An attacker can escape the browser sandbox, gaining access to the operating system and user data.

Recommendation

Immediately update Firefox browsers and Thunderbird clients to the patched versions.

Original NVD description (English source)

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.