Mozilla Firefox 153 Security Bulletin: Fixes for Multiple Critical Vulnerabilities Including UAF and Sandbox Escape

Vulnerability Overview The Mozilla Foundation has released security advisory 2026-68, indicating that multiple security vulnerabilities have been fixed in Firefox 153. These vulnerabilities affect various components, including DOM, WebRTC, JavaScript, Audio/Video, Graphics, Networking, PDF Viewer, and Service Workers. Affected Scope High Impact: Multiple vulnerabilities are classified as high impact, including: - CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component - CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component - CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component - CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component - CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component - CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component - CVE-2026-16364: Incorrect boundary conditions in the Audio/Video: Playback component - CVE-2026-16365: Privilege escalation in the DOM: Workers component - CVE-2026-16366: Privilege escalation in the DOM: Navigation component - CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component - CVE-2026-16354: Information disclosure in the Graphics: ImageLib component - CVE-2026-16367: Sandbox escape due to invalid pointer in the Disability Access APIs component - CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component - CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component - CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component - CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component - CVE-2026-16357: Incorrect boundary conditions in the Graphics component Medium Impact: Some vulnerabilities are classified as medium impact, including: - CVE-2026-16370: Mitigation bypass in the DOM: Networking component - CVE-2026-16371: Privilege escalation in the DOM: Navigation component - CVE-2026-16372: Privilege escalation in the DOM: Content Processes component - CVE-2026-16373: Information disclosure in the Privacy component in Firefox for Android - CVE-2026-16374: Information disclosure in the Framework component in DevTools - CVE-2026-16375: Site isolation issue in the Networking: HTTP component - CVE-2026-16376: Denial-of-service in the Graphics: WebGPU component - CVE-2026-16377: Mitigation bypass in the PDF Viewer component - CVE-2026-16378: Other issue in the DOM: Copy & Paste and Drag & Drop component - CVE-2026-16379: Privilege escalation in the DOM: Content Processes component - CVE-2026-16358: Site isolation issue in the Graphics: WebRender component - CVE-2026-16380: Mitigation bypass in the Networking component - CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component - CVE-2026-16382: Mitigation bypass in the DOM: Service Workers component Remediation All listed vulnerabilities have been fixed in Firefox 153. Users are advised to upgrade to Firefox 153 as soon as possible to address these security issues. POC Code or Exploit Code No specific POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Firefox 153 Security Bulletin: Fixes for Multiple Critical Vulnerabilities Including UAF and Sandbox Escape