CVE-2026-16351 is a use-after-free vulnerability in the DOM Navigation component of Mozilla Firefox and Thunderbird that enables sandbox escape. This memory safety issue could allow an attacker to execute arbitrary code outside the browser sandbox, potentially compromising the system. The vulnerability was reported by Yaqoub Aldurayhim and fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS v3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Mozilla’s official advisories confirm the availability of patches and recommend updating to the fixed versions.

Successful exploitation of this use-after-free vulnerability can lead to sandbox escape, allowing an attacker to execute arbitrary code with the privileges of the affected application. This compromises the confidentiality, integrity, and availability of the system running the vulnerable Firefox or Thunderbird versions. The CVSS score of 9.8 indicates a critical severity level. No confirmed exploitation in the wild has been reported, but the vulnerability is considered highly impactful due to its potential for arbitrary code execution without user interaction or privileges.

Mozilla has released official fixes for this vulnerability in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. Users and administrators should update to these versions or later to remediate the issue. The vendor advisories do not indicate any temporary mitigations or workarounds; applying the official patches is the recommended and effective remediation. Patch status is confirmed by Mozilla advisories linked in the source data.