Vulnerability-Lookup

alsa-2026:49922

Vulnerability from osv_almalinux

Published

2026-08-04 00:00

Modified

2026-08-04 16:48

Summary

Important: thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:49922	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-14899	REPORT
	https://access.redhat.com/security/cve/CVE-2026-15718	REPORT
	https://access.redhat.com/security/cve/CVE-2026-15719	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16349	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16350	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16351	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16352	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16353	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16354	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16355	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16356	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16357	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16358	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16359	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16360	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16361	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16362	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16363	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16368	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16369	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16371	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16374	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16375	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16377	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16379	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16381	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16383	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16387	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16390	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16391	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16396	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16405	REPORT
	https://access.redhat.com/security/cve/CVE-2026-16412	REPORT
	https://bugzilla.redhat.com/2499973	REPORT
	https://bugzilla.redhat.com/2499974	REPORT
	https://bugzilla.redhat.com/2503415	REPORT
	https://bugzilla.redhat.com/2503416	REPORT
	https://bugzilla.redhat.com/2503420	REPORT
	https://bugzilla.redhat.com/2503423	REPORT
	https://bugzilla.redhat.com/2503425	REPORT
	https://bugzilla.redhat.com/2503430	REPORT
	https://bugzilla.redhat.com/2503432	REPORT
	https://bugzilla.redhat.com/2503434	REPORT
	https://bugzilla.redhat.com/2503439	REPORT
	https://bugzilla.redhat.com/2503440	REPORT
	https://bugzilla.redhat.com/2503444	REPORT
	https://bugzilla.redhat.com/2503451	REPORT
	https://bugzilla.redhat.com/2503454	REPORT
	https://bugzilla.redhat.com/2503456	REPORT
	https://bugzilla.redhat.com/2503463	REPORT
	https://bugzilla.redhat.com/2503472	REPORT
	https://bugzilla.redhat.com/2503473	REPORT
	https://bugzilla.redhat.com/2503485	REPORT
	https://bugzilla.redhat.com/2503489	REPORT
	https://bugzilla.redhat.com/2503491	REPORT
	https://bugzilla.redhat.com/2503497	REPORT
	https://bugzilla.redhat.com/2503498	REPORT
	https://bugzilla.redhat.com/2503500	REPORT
	https://bugzilla.redhat.com/2503501	REPORT
	https://bugzilla.redhat.com/2503505	REPORT
	https://bugzilla.redhat.com/2503512	REPORT
	https://bugzilla.redhat.com/2503513	REPORT
	https://bugzilla.redhat.com/2503517	REPORT
	https://bugzilla.redhat.com/2503521	REPORT
	https://bugzilla.redhat.com/2503527	REPORT
	https://bugzilla.redhat.com/2506217	REPORT
	https://errata.almalinux.org/8/ALSA-2026-49922.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "thunderbird"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.13.0-1.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n  * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:49922",
  "modified": "2026-08-04T16:48:16Z",
  "published": "2026-08-04T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:49922"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14899"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15718"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15719"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16349"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16350"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16351"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16352"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16353"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16354"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16355"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16356"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16357"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16358"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16359"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16360"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16361"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16362"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16363"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16368"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16369"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16371"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16374"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16375"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16377"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16379"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16381"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16383"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16387"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16390"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16391"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16396"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16405"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16412"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2499973"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2499974"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503415"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503416"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503420"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503423"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503425"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503430"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503432"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503439"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503440"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503444"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503451"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503454"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503472"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503473"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503485"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503489"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503491"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503497"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503498"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503500"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503501"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503505"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503512"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503513"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503517"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503521"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2503527"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2506217"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-49922.html"
    }
  ],
  "related": [
    "CVE-2026-15719",
    "CVE-2026-15718",
    "CVE-2026-16390",
    "CVE-2026-16350",
    "CVE-2026-16391",
    "CVE-2026-16375",
    "CVE-2026-16356",
    "CVE-2026-16363",
    "CVE-2026-16412",
    "CVE-2026-16381",
    "CVE-2026-16355",
    "CVE-2026-16361",
    "CVE-2026-16352",
    "CVE-2026-16368",
    "CVE-2026-16377",
    "CVE-2026-16360",
    "CVE-2026-16362",
    "CVE-2026-16358",
    "CVE-2026-16387",
    "CVE-2026-16349",
    "CVE-2026-16357",
    "CVE-2026-16351",
    "CVE-2026-16371",
    "CVE-2026-16379",
    "CVE-2026-16354",
    "CVE-2026-16374",
    "CVE-2026-16359",
    "CVE-2026-16383",
    "CVE-2026-16369",
    "CVE-2026-16353",
    "CVE-2026-16396",
    "CVE-2026-16405",
    "CVE-2026-14899"
  ],
  "summary": "Important: thunderbird security update"
}

CVE-2026-16356 (GCVE-0-2026-16356)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Sandbox escape due to use-after-free in the Disability Access APIs component

Summary

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free
CWE-693 - Protection Mechanism Failure

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2052562
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16356",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:39:06.937298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:44:53.766Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:30.529Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2052562"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the Disability Access APIs component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16356",
    "datePublished": "2026-07-21T12:37:44.585Z",
    "dateReserved": "2026-07-20T21:56:01.537Z",
    "dateUpdated": "2026-07-22T19:18:30.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16357 (GCVE-0-2026-16357)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Incorrect boundary conditions in the Graphics component

Summary

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2053326
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

5up3rh3i

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16357",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:40:12.443582Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:44:48.103Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "5up3rh3i"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:31.600Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2053326"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Incorrect boundary conditions in the Graphics component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16357",
    "datePublished": "2026-07-21T12:37:45.425Z",
    "dateReserved": "2026-07-20T21:56:03.705Z",
    "dateUpdated": "2026-07-22T19:18:31.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16358 (GCVE-0-2026-16358)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Site isolation issue in the Graphics: WebRender component

Summary

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-346 - Origin Validation Error

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2040119
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Hcamael

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16358",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T17:09:07.744606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T17:29:50.162Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Hcamael"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:42.429Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2040119"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Site isolation issue in the Graphics: WebRender component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16358",
    "datePublished": "2026-07-21T12:37:54.669Z",
    "dateReserved": "2026-07-20T21:56:05.445Z",
    "dateUpdated": "2026-07-22T19:18:42.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16359 (GCVE-0-2026-16359)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:38 – Updated: 2026-07-22 19:18

Title

Incorrect boundary conditions in the Audio/Video: GMP component

Summary

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2045424
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Jacolon Walker

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16359",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T19:43:36.531190Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T19:43:44.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jacolon Walker"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:58.528Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2045424"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Incorrect boundary conditions in the Audio/Video: GMP component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16359",
    "datePublished": "2026-07-21T12:38:07.338Z",
    "dateReserved": "2026-07-20T21:56:07.912Z",
    "dateUpdated": "2026-07-22T19:18:58.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16360 (GCVE-0-2026-16360)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:38 – Updated: 2026-07-24 03:55

Title

Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

Summary

Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

7 references

URL	Tags
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2…
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Andrew McCreight, Jan de Mooij, Tom Ritter, Vincent Hilla and the Mozilla Fuzzing Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16360",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T03:55:35.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Andrew McCreight, Jan de Mooij, Tom Ritter, Vincent Hilla and the Mozilla Fuzzing Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T14:55:58.475Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "High-severity memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153",
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022635%2C2028004%2C2035756%2C2045184%2C2045185%2C2045198%2C2045392%2C2045395%2C2045396%2C2045397%2C2045405%2C2045414%2C2045415%2C2045451%2C2045454%2C2045508%2C2045510%2C2045513%2C2045515%2C2045518%2C2045604%2C2045607%2C2045612%2C2045617%2C2045619%2C2045624%2C2045625%2C2045729%2C2045737%2C2045741%2C2045742%2C2045763%2C2045767%2C2045770%2C2045772%2C2045773%2C2045783%2C2045833%2C2045848%2C2045865%2C2045875%2C2045957%2C2047723%2C2047729%2C2048795%2C2048799%2C2048801%2C2049392%2C2049397%2C2049398%2C2049399%2C2049404%2C2049405%2C2049407%2C2049812%2C2050657%2C2050668%2C2050990%2C2053166%2C2053273%2C2053576%2C2053583%2C2053587"
        },
        {
          "name": "Moderate-severity memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153",
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043739%2C2045281%2C2045614%2C2045744%2C2045775%2C2047719%2C2049805%2C2051666"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16360",
    "datePublished": "2026-07-21T12:38:24.293Z",
    "dateReserved": "2026-07-20T21:56:09.806Z",
    "dateUpdated": "2026-07-24T03:55:35.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16361 (GCVE-0-2026-16361)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:38 – Updated: 2026-07-24 03:55

Title

Memory safety bugs fixed in Thunderbird ESR 140.13

Summary

Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

4 references

URL	Tags
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.38 , ≤ 115.* (rpm) Unaffected: 140.13 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ * (rpm)

Credits

The Mozilla Fuzzing Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16361",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T03:55:36.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.38",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The Mozilla Fuzzing Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13."
            }
          ],
          "value": "Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:19:43.379Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "High-severity memory safety bugs fixed in Thunderbird ESR 140.13",
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029734%2C2036518"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Memory safety bugs fixed in Thunderbird ESR 140.13"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16361",
    "datePublished": "2026-07-21T12:38:27.370Z",
    "dateReserved": "2026-07-20T21:56:10.203Z",
    "dateUpdated": "2026-07-24T03:55:36.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16362 (GCVE-0-2026-16362)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Use-after-free in the WebRTC: Audio/Video component

Summary

Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2043188
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

crixer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:49:35.494055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T17:30:38.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "crixer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:16.408Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2043188"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Use-after-free in the WebRTC: Audio/Video component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16362",
    "datePublished": "2026-07-21T12:37:33.621Z",
    "dateReserved": "2026-07-20T21:56:10.605Z",
    "dateUpdated": "2026-07-22T19:18:16.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16363 (GCVE-0-2026-16363)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

JIT miscompilation in the JavaScript: WebAssembly component

Summary

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
CWE-682 - Incorrect Calculation

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2047689
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Nebula Security

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:24:01.013422Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-682",
                "description": "CWE-682 Incorrect Calculation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:46:12.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Nebula Security"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:19.673Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2047689"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "JIT miscompilation in the JavaScript: WebAssembly component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16363",
    "datePublished": "2026-07-21T12:37:36.171Z",
    "dateReserved": "2026-07-20T21:56:13.042Z",
    "dateUpdated": "2026-07-22T19:18:19.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16368 (GCVE-0-2026-16368)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Incorrect boundary conditions in the JavaScript: WebAssembly component

Summary

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2051015
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Nebula Security

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16368",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:36:45.443388Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T15:45:12.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Nebula Security"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:27.328Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2051015"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Incorrect boundary conditions in the JavaScript: WebAssembly component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16368",
    "datePublished": "2026-07-21T12:37:41.992Z",
    "dateReserved": "2026-07-20T21:56:23.990Z",
    "dateUpdated": "2026-07-22T19:18:27.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16369 (GCVE-0-2026-16369)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:37 – Updated: 2026-07-22 19:18

Title

Integer overflow in the JavaScript: WebAssembly component

Summary

Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2051854
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.13 , ≤ 140.* (rpm) Unaffected: 153 , ≤ * (rpm)

Credits

Amy Burnett of OpenAI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-16369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T15:50:14.676675Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T17:30:31.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.13",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Amy Burnett of OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
            }
          ],
          "value": "Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:18:28.400Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2051854"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/"
        }
      ],
      "title": "Integer overflow in the JavaScript: WebAssembly component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-16369",
    "datePublished": "2026-07-21T12:37:42.865Z",
    "dateReserved": "2026-07-20T21:56:26.427Z",
    "dateUpdated": "2026-07-22T19:18:28.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

alsa-2026:49922

Vulnerability from osv_almalinux

CVE-2026-16356 (GCVE-0-2026-16356)

CVE-2026-16357 (GCVE-0-2026-16357)

CVE-2026-16358 (GCVE-0-2026-16358)

CVE-2026-16359 (GCVE-0-2026-16359)

CVE-2026-16360 (GCVE-0-2026-16360)

CVE-2026-16361 (GCVE-0-2026-16361)

CVE-2026-16362 (GCVE-0-2026-16362)

CVE-2026-16363 (GCVE-0-2026-16363)

CVE-2026-16368 (GCVE-0-2026-16368)

CVE-2026-16369 (GCVE-0-2026-16369)

Tags

Sightings

Nomenclature