CVE-2026-16367

CriticalCVSS 10.0

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Sandbox escape vulnerability due to invalid pointer in the Disability Access APIs component. Fixed in Firefox 153 and Thunderbird 153.

Risk of sandbox escape, allowing an attacker to execute code outside browser restrictions.

Update Firefox to version 153 and Thunderbird to version 153.

Original NVD description (English source)

Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.