CVE-2026-16367
A critical vulnerability in the Disability Access APIs component allows an attacker to escape the sandbox and execute arbitrary code. The flaw is caused by an invalid pointer that can be exploited remotely without authentication or user interaction. The issue has been fixed in Firefox 153 and Thunderbird 153.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Firefox and Thunderbird browsers, versions prior to 153, on any platform.
Real-world impact
An attacker could run arbitrary code on the victim’s machine, potentially taking full control, stealing data, or installing malware.
Why this severity
The CVSS score of 10 reflects that the vulnerability can be exploited remotely with no authentication or user interaction, giving an attacker full control over the system.
What to do about it
- 01Upgrade Firefox to version 153 or later.
- 02Upgrade Thunderbird to version 153 or later.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 24, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- bugzilla.mozilla.org/show_bug.cgipermissions required
- mozilla.org/security/advisories/mfsa202…vendor advisory
- mozilla.org/security/advisories/mfsa202…vendor advisory