CVE-2026-16360

CRITICAL

Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

Title source: cna

Description

Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

References (7)

Core 7

Core References

Moderate-severity memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043739%2C2045281%2C2045614%2C2045744%2C2045775%2C2047719%2C2049805%2C2051666

https://www.mozilla.org/security/advisories/mfsa2026-68/

https://www.mozilla.org/security/advisories/mfsa2026-69/

High-severity memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022635%2C2028004%2C2035756%2C2045184%2C2045185%2C2045198%2C2045392%2C2045395%2C2045396%2C2045397%2C2045405%2C2045414%2C2045415%2C2045451%2C2045454%2C2045508%2C2045510%2C2045513%2C2045515%2C2045518%2C2045604%2C2045607%2C2045612%2C2045617%2C2045619%2C2045624%2C2045625%2C2045729%2C2045737%2C2045741%2C2045742%2C2045763%2C2045767%2C2045770%2C2045772%2C2045773%2C2045783%2C2045833%2C2045848%2C2045865%2C2045875%2C2045957%2C2047723%2C2047729%2C2048795%2C2048799%2C2048801%2C2049392%2C2049397%2C2049398%2C2049399%2C2049404%2C2049405%2C2049407%2C2049812%2C2050657%2C2050668%2C2050990%2C2053166%2C2053273%2C2053576%2C2053583%2C2053587

https://www.mozilla.org/security/advisories/mfsa2026-70/

https://www.mozilla.org/security/advisories/mfsa2026-71/

https://www.mozilla.org/security/advisories/mfsa2026-72/

Scores

CVSS v3 9.8

EPSS 0.0033

EPSS Percentile 25.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-119

Status published

Products (8)

mozilla/firefox < 115.38.0

mozilla/firefox < 153.0.0

Mozilla/Firefox 115.38 - 115.*

Mozilla/Firefox 140.13 - 140.*

Mozilla/Firefox 153

mozilla/thunderbird < 140.13.0

Mozilla/Thunderbird 140.13 - 140.*

Mozilla/Thunderbird 153

Published Jul 21, 2026

Tracked Since Jul 21, 2026