CVE-2026-16412
CRITICALMemory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
Title source: cnaDescription
Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
References (7)
Core 7
Core References
Moderate-severity memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2005113%2C2025369%2C2026301%2C2028663%2C2029761%2C2042242%2C2043271%2C2043300%2C2044612%2C2045378%2C2045406%2C2045407%2C2045616%2C2045626%2C2045730%2C2045732%2C2045769%2C2045771%2C2047957%2C2048934%2C2049818%2C2049822%2C2050151%2C2050368%2C2051653%2C2051658
High-severity memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043035%2C2045057%2C2045187%2C2045402%2C2045417%2C2045482%2C2045611%2C2045618%2C2045756%2C2046917%2C2047718
Low-severity memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045413%2C2053635%2C2053637
Scores
CVSS v3
9.8
EPSS
0.0033
EPSS Percentile
25.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-119
Status
published
Products (6)
mozilla/firefox
< 153.0.0
mozilla/firefox
140.1.0 - 140.13.0
Mozilla/Firefox
140.13 - 140.*
Mozilla/Firefox
153
Mozilla/Thunderbird
140.13 - 140.*
Mozilla/Thunderbird
153
Published
Jul 21, 2026
Tracked Since
Jul 21, 2026