Skip to main content

Mozilla Firefox CVE-2026-16368

| EUVDEUVD-2026-46201 CRITICAL
Buffer Overflow (CWE-119)
2026-07-21 mozilla GHSA-h7w4-g832-m899
Buffer Overflow Red Hat Mozilla
9.8
CVSS 3.1 · Vendor: mozilla
Share

Severity by source

Vendor (mozilla) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Network-delivered via malicious web content with low complexity and no privileges, but realistically requires the victim to load a page (UI:R); high memory-corruption impact within the unprivileged content process (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 22, 2026 - 17:08 vuln.today
CVSS changed
Jul 22, 2026 - 16:22 NVD
9.8 (CRITICAL)
CVE Published
Jul 21, 2026 - 12:37 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 21, 2026 - 12:37 cve.org
CRITICAL 9.8

DescriptionCVE.org

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.

AnalysisAI

Memory corruption in Mozilla Firefox's WebAssembly (JavaScript) engine allows remote attackers to trigger a buffer overflow through incorrect boundary condition handling, potentially leading to arbitrary code execution in the browser content process. The flaw carries a critical CVSS 9.8 and affects Firefox prior to version 153 and Firefox ESR prior to 140.13; it is fixed in those releases per Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation in the wild has not yet been observed.

Technical ContextAI

WebAssembly (Wasm) is a low-level bytecode format executed by Firefox's JavaScript engine (SpiderMonkey) to run near-native-speed compiled code in the browser. This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), meaning the Wasm component performs a read or write outside the intended memory buffer due to an incorrect boundary condition - the tag 'Buffer Overflow' confirms this class. Wasm memory access and JIT compilation are historically high-value targets because miscalculated bounds in linear memory or the compiler's generated code can be steered into out-of-bounds reads/writes. The CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* indicates the Firefox application itself across affected versions is the impacted product.

RemediationAI

Vendor-released patch: upgrade to Firefox 153 or, for extended-support deployments, Firefox ESR 140.13, as documented in Mozilla advisories MFSA2026-68 (https://www.mozilla.org/security/advisories/mfsa2026-68/) and MFSA2026-70 (https://www.mozilla.org/security/advisories/mfsa2026-70/). Because Firefox auto-updates by default, ensure automatic updates are enabled and force a restart to apply the fix across managed fleets. As an interim compensating control where patching is delayed, disabling WebAssembly by setting javascript.options.wasm to false in about:config removes the vulnerable component's attack surface, though this will break sites and web apps that rely on Wasm; broader hardening such as restricting browsing to trusted sites or deploying content filtering reduces exposure to malicious pages but does not eliminate the flaw.

More in Mozilla

View all
CVE-2015-4495 HIGH POC
8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2013-0643 HIGH
8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected

Share

CVE-2026-16368 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy