CVE Catalog
CVE-2026-16356
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.42%
34th percentile - higher than 34% of all known CVEs
Summary
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Risk Assessment
An attacker can escape the browser sandbox and gain access to the operating system, allowing full control over the device.
Recommendation
Update Firefox and Thunderbird to the patched versions.
Original NVD description (English source)
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.