CVE-2026-16367
published 2026-07-21CVE-2026-16367: Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
PriorityP357critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
0.38%
30.1th percentile
Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < Firefox 153 | Firefox 153 |
| mozilla | firefox | < 153.0.0 | 153.0.0 |
| mozilla | thunderbird | < Thunderbird 153 | Thunderbird 153 |
| mozilla | thunderbird | < 153.0 | 153.0 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: thunderbird: Sandbox escape due to invalid pointer in the Disability Access APIs component
vendor_redhat·2026-07-21·CVSS 10.0
CVE-2026-16367 [CRITICAL] firefox: thunderbird: Sandbox escape due to invalid pointer in the Disability Access APIs component
firefox: thunderbird: Sandbox escape due to invalid pointer in the Disability Access APIs component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape due to invalid pointer in the Disability Access APIs component
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/firefox-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/thunderbird-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 10) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird
Mozilla
Mozilla Foundation Security Advisory 2026-71: CVE-2026-16367
vendor_mozilla
CVE-2026-16367 Mozilla Foundation Security Advisory 2026-71: CVE-2026-16367
Mozilla Foundation Security Advisory 2026-71
CVE: CVE-2026-16367
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 153
Mozilla
Mozilla Foundation Security Advisory 2026-68: CVE-2026-16367
vendor_mozilla
CVE-2026-16367 Mozilla Foundation Security Advisory 2026-68: CVE-2026-16367
Mozilla Foundation Security Advisory 2026-68
CVE: CVE-2026-16367
Product: Firefox
Impact: high
Fixed in: Firefox 153
GHSA
Sandbox escape due to invalid pointer in the Disability Access APIs component.
ghsa_unreviewed·2026-07-21
CVE-2026-16367 [CRITICAL] CWE-119 Sandbox escape due to invalid pointer in the Disability Access APIs component.
Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-16367 firefox: thunderbird: Sandbox escape due to invalid pointer in the Disability Access APIs component
bugzilla·2026-07-21·CVSS 10.0
CVE-2026-16367 [CRITICAL] CVE-2026-16367 firefox: thunderbird: Sandbox escape due to invalid pointer in the Disability Access APIs component
CVE-2026-16367 firefox: thunderbird: Sandbox escape due to invalid pointer in the Disability Access APIs component
Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153.
Bugzilla
CVE-2026-53196 kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()
bugzilla·2026-06-25
CVE-2026-53196 [HIGH] CVE-2026-53196 kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()
CVE-2026-53196 kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: io_ti: fix heap overflow in get_manuf_info()
get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the
device I2C EEPROM into a buffer allocated with kmalloc_obj(), which
is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.
The Size field comes from the device and is only validated (in
check_i2c_image()) to make sure the descriptor fits within
TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.
A malicious USB device can therefore set Size to any value up to 16377,
causing a heap overflow of up to 16367 bytes when plugged into a host
running this driver.
valid_csum() is called after read_rom() an
2026-07-21
Published