Loading vulnerability…
Invalid pointer in Firefox and Thunderbird DOM WebIDL bindings
CVE-2026-16353 is an invalid-pointer vulnerability in the DOM: Bindings (WebIDL) component of Mozilla Firefox and Thunderbird. The specific faulty function and pointer-lifetime mechanism are not identified. Potential consequences include application crashes or arbitrary code execution, but these outcomes are not confirmed for this individual vulnerability. Fixes are included in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Potential application crashes and possibly arbitrary code execution have been identified as possible consequences, not established outcomes. The exact security impact of this individual invalid-pointer flaw is currently unavailable. Broader advisory claims concerning sandbox escape, information disclosure, and security-policy bypass cannot be attributed specifically to CVE-2026-16353.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented. Apply the fixed application version or the corresponding distribution security update.
Patch, then assume compromise.
Upgrade to Firefox 153 or later, Firefox ESR 115.38 or later on the 115 ESR branch, Firefox ESR 140.13 or later on the 140 ESR branch, Thunderbird 153 or later, or Thunderbird 140.13 or later on the corresponding supported branch. On Debian 13 (trixie), install firefox-esr 140.13.0esr-1~deb13u1 or later and thunderbird 1:140.13.0esr-2~deb13u1 or later through security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.