CVE-2026-16360 encompasses several memory safety bugs in Mozilla Firefox ESR 115.37, ESR 140.12, and Firefox 152. These bugs showed evidence of memory corruption and were presumed exploitable for arbitrary code execution. The vulnerabilities were fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. The CVSS v3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisories confirm the fixes and provide detailed references to multiple related bugs. No known exploits in the wild have been reported at this time.

Successful exploitation of these memory safety bugs could allow an attacker to execute arbitrary code remotely without user interaction or privileges, compromising confidentiality, integrity, and availability of the affected systems running vulnerable Firefox versions. This poses a critical risk to users of the specified Firefox ESR and standard Firefox versions prior to the fixed releases.

Mozilla has released official fixes for these vulnerabilities in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Users and administrators should update to these fixed versions immediately to mitigate the risk. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by the vendor advisories linked. No additional mitigations beyond applying the official updates are specified.