CVE-2026-16352 is a use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox that enables sandbox escape. This flaw was addressed and fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. The Mozilla advisories classify the impact as high and note that the vulnerability could allow an attacker to escape the sandbox protections of the browser. The vendor has released official fixes in the stated versions. No public exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment of Firefox, potentially leading to execution of arbitrary code outside the browser sandbox. This elevates the risk of system compromise from a browser-based attack vector. The vendor rates the impact as high. No known active exploitation has been observed.

This vulnerability has been fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Users and administrators should update to these versions or later to remediate the issue. Since this is a client application, patching is the primary mitigation. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.