CVE-2026-16367

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

10.0 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H                                    

Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Published Date

July 21, 2026

Last Modified

July 22, 2026

CWE ID

CWE-119

Source

NVD

Vendor

Mozilla

Product

Firefox