Advisory · CVE-2026-16367
Firefox sandbox escape breaks the browser's last wall
An invalid pointer in Firefox's Disability Access APIs allows a sandbox escape, fixed in Firefox 153 and Thunderbird 153.
- Vendor
- Mozilla
- Product
- Firefox
- Identifier / CWE
- CVE-2026-16367
CWE-119 - Action timing
- Immediate
Explain it like I’m five
Your browser keeps websites inside a padded playpen so they cannot touch your computer. This bug is a loose panel in the playpen wall: something already inside can push through to the rest of the machine.
- 01Attacker code runs in content process
The attacker first needs code execution inside Firefox's sandboxed content process, typically via a separate renderer exploit.
- 02Disability Access APIs abused
The invalid pointer flaw in the Disability Access APIs component is triggered from the compromised process.
- 03Sandbox boundary crossed
The flaw allows escape from the sandbox into a more privileged context.
- 04Host exposed
With the sandbox defeated, the attacker can act on the host with far fewer restrictions.
What happened
Mozilla fixed CVE-2026-16367, a sandbox escape caused by an invalid pointer in the Disability Access APIs component, in Firefox 153 and Thunderbird 153 (advisories MFSA2026-68 and MFSA2026-71, announced July 21, 2026). The issue was reported by Nebula Security; Mozilla rates its own impact as high. The NVD CVSS 3.1 score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). As a sandbox escape, it is a second-stage primitive: practical exploitation normally requires chaining it with a separate vulnerability that first achieves code execution inside the browser’s sandboxed content process. There is no confirmed public exploitation at the time of writing.
What to do
- Update Firefox to version 153 or later and Thunderbird to version 153 or later across the fleet, including ESR channels per Mozilla’s advisory guidance.
- Verify update coverage with endpoint management tooling; browsers are high-exposure software and stragglers matter.
- Treat any endpoint showing anomalous browser child-process behavior as potentially compromised and investigate it as a possible exploit chain.
Management note
On its own this bug needs a partner to do damage, which is why it is patch-soon rather than drop-everything. But sandbox escapes are the bugs that turn an ordinary drive-by browser exploit into full host compromise, so they are exactly the class of flaw that makes the difference between a contained incident and a bad one. Keep browser updates boring and automatic.