CVE-2026-16360 encompasses a set of memory safety bugs affecting Mozilla Firefox ESR 115.37, ESR 140.12, and Firefox 152. These bugs involve memory corruption that could potentially allow arbitrary code execution if exploited. The vulnerabilities were fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. The Mozilla advisories detail multiple related high-impact memory safety issues including use-after-free, invalid pointer dereferences, and boundary condition errors in components such as DOM navigation, Audio/Video, WebRTC, JavaScript engine, and Graphics subsystems. While exploit code is publicly known for some related issues, no active exploitation of these specific memory safety bugs has been observed.

The vulnerabilities could allow attackers to execute arbitrary code due to memory corruption issues in affected Firefox versions. This could lead to privilege escalation, sandbox escapes, or information disclosure depending on the specific bug exploited. The impact is considered high due to the potential for remote code execution in a widely used browser. However, no confirmed exploitation in the wild has been reported.

Official fixes are available and have been released by Mozilla. Users and administrators should update to Firefox 153, Firefox ESR 115.38, or Firefox ESR 140.13 to remediate these vulnerabilities. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.