CVE-2026-16352 is a use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox and Thunderbird that enables sandbox escape. This vulnerability was addressed and fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The flaw allows an attacker to execute code outside the sandbox, potentially compromising the security boundary. The CVSS v3.1 base score is 9.8, reflecting critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Mozilla has published official security advisories detailing the fix and related vulnerabilities.

Successful exploitation of this use-after-free vulnerability can lead to sandbox escape, allowing an attacker to execute arbitrary code with elevated privileges outside the sandbox environment. This compromises the security model of Firefox and Thunderbird, potentially leading to full system compromise. The vulnerability is rated critical with a CVSS score of 9.8, indicating a severe risk to affected users if unpatched.

This vulnerability has been fixed by Mozilla in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. Users and administrators should update to these versions or later to remediate the issue. No additional mitigations are required beyond applying the official patches provided by Mozilla. Refer to Mozilla's security advisories at https://www.mozilla.org/security/advisories/mfsa2026-68/ and related advisories for detailed guidance.