CVE-2026-16368 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-16368 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-16368 is an incorrect boundary-condition vulnerability in Mozilla Firefox and Thunderbird's JavaScript WebAssembly component, affecting the handling of WebAssembly content processed by the applications.

Technical Detail

The flaw involves incorrect boundary handling in the JavaScript WebAssembly component. An attacker may be able to trigger the issue by causing a vulnerable Firefox or Thunderbird instance to process crafted WebAssembly content, such as content delivered through a web page or message-rendered content. Successful exploitation could result in memory-safety impact and potentially enable arbitrary code execution in the context of the affected application; the available advisory information does not specify the exact exploitation primitive or required conditions.

Exploitation Status

No known exploit has been reported as of July 28, 2026. CVE-2026-16368 is not listed in CISA's Known Exploited Vulnerabilities Catalog.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Update Firefox to version 153 or later, Firefox ESR to version 140.13 or later, Thunderbird to version 153 or later, or Thunderbird ESR to version 140.13 or later. Prioritize updates for systems that regularly process untrusted web content or email content. No vendor-supported workaround, exploitation detection signature, or confirmed indicators of compromise have been published; organizations should verify deployment through software inventory and version-compliance monitoring.