Loading vulnerability…
Use-after-free in Firefox and Thunderbird WebRTC Audio/Video
CVE-2026-16362 is a use-after-free vulnerability in the WebRTC Audio/Video component of Mozilla Firefox and Thunderbird. Exploitation could cause memory corruption, potentially leading to arbitrary code execution or an application crash. The vulnerability is fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The specific vulnerable function and triggering sequence are not currently available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could cause memory corruption and potentially arbitrary code execution or an application crash. The execution privilege level and any ability to escape a sandbox are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is currently available. Apply the relevant security update.
Patch, then assume compromise.
Upgrade to Firefox 153, Firefox ESR 140.13, Thunderbird 153, or Thunderbird 140.13, or a later security-maintained release of the corresponding branch. On Debian 13 (trixie), upgrade firefox-esr to 140.13.0esr-1~deb13u1 or later and thunderbird to 1:140.13.0esr-2~deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.