Loading vulnerability…
Sandbox escape in Firefox and Thunderbird Disability Access APIs
CVE-2026-16356 is a use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox and Thunderbird that can permit sandbox escape. The vulnerability is fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The specific vulnerable function and triggering conditions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass sandbox isolation in Firefox or Thunderbird. Specific resulting confidentiality, integrity, or availability impacts beyond sandbox escape are not established for this vulnerability.
If you can’t patch tonight, do this now.
No specific interim workaround is documented. Apply the applicable security update.
Patch, then assume compromise.
Upgrade to Firefox 153 or later, Firefox ESR 115.38 or later, Firefox ESR 140.13 or later, Thunderbird 153 or later, or Thunderbird 140.13 or later within the applicable release branch. On Debian 13 (trixie), install firefox-esr 140.13.0esr-1~deb13u1 or later and thunderbird 1:140.13.0esr-2~deb13u1 or later through security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.