Executive brief
Mozilla has released security updates to address multiple memory safety vulnerabilities in the Firefox web browser. If exploited, these flaws could allow an attacker to crash the browser or potentially execute malicious code on a user's computer. This typically occurs if a user visits a specially crafted malicious website.
Technical details
This advisory covers a collection of memory safety bugs (CVE-2026-16360) identified through internal testing and fuzzing. The vulnerabilities manifest as memory corruption issues within the browser engine. An attacker could potentially exploit these flaws by enticing a user to process malicious web content, leading to arbitrary code execution within the context of the browser process. The issues were identified by Andrew McCreight, Jan de Mooij, Tom Ritter, Vincent Hilla, and the Mozilla Fuzzing Team. Patches are available in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
Affected products
- Mozilla Firefox 152
- Mozilla Firefox ESR 115.37, 140.12
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched
References
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022635%2C2028004%2C2035756%2C2045184%2C2045185%2C2045198%2C2045392%2C2045395%2C2045396%2C2045397%2C2045405%2C2045414%2C2045415%2C2045451%2C2045454%2C2045508%2C2045510%2C2045513%2C2045515%2C2045518%2C2045604%2C2045607%2C2045612%2C2045617%2C2045619%2C2045624%2C2045625%2C2045729%2C2045737%2C2045741%2C2045742%2C2045763%2C2045767%2C2045770%2C2045772%2C2045773%2C2045783%2C2045833%2C2045848%2C2045865%2C2045875%2C2045957%2C2047723%2C2047729%2C2048795%2C2048799%2C2048801%2C2049392%2C2049397%2C2049398%2C2049399%2C2049404%2C2049405%2C2049407%2C2049812%2C2050657%2C2050668%2C2050990%2C2053166%2C2053273%2C2053576%2C2053583%2C2053587
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043739%2C2045281%2C2045614%2C2045744%2C2045775%2C2047719%2C2049805%2C2051666
- https://www.mozilla.org/security/advisories/mfsa2026-68/
- https://www.mozilla.org/security/advisories/mfsa2026-69/
- https://www.mozilla.org/security/advisories/mfsa2026-70/