CVE-2026-16367

Undergoing Analysis Undergoing Analysis - In Progress

Firefox Sandbox Escape via Disability Access APIs Pointer Issue

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Mozilla Corporation

Description

Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-10

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16367

EUVD

EUVD-2026-46200

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 153.0 (exc)
mozilla	firefox	to 153.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This is a sandbox escape vulnerability caused by an invalid pointer in the Disability Access APIs component of Firefox. It allows an attacker to break out of the browser's sandbox security restrictions.

Detection Guidance

This vulnerability is specific to Firefox 153 and involves a sandbox escape via invalid pointer in Disability Access APIs. Detection requires checking Firefox version and monitoring for unusual activity.

Impact Analysis

This vulnerability could allow malicious code to execute outside the browser's sandbox, potentially gaining unauthorized access to system resources or sensitive data on your device.

Compliance Impact

This vulnerability allows sandbox escape with high impact on confidentiality, integrity, and availability, which could lead to unauthorized data access or modification. Such breaches may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update Firefox to version 153 or later to address the sandbox escape vulnerability in the Disability Access APIs component.

Hi! I’m here to help you understand CVE-2026-16367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70