CVE-2026-16363

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

34th percentile - higher than 34% of all known CVEs

Summary

JIT miscompilation in the JavaScript: WebAssembly component. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Risk Assessment

May lead to incorrect WebAssembly code execution and potential privilege escalation in the browser.

Recommendation

Update Firefox browsers and Thunderbird clients to the patched versions.

Original NVD description (English source)

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.