CVE-2026-16351 Sandbox escape due to use-after-free in the DOM: Navigation component
A use-after-free flaw in the DOM Navigation component allows attackers to escape the sandbox and execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-16351?
CVE-2026-16351 is a critical use after free vulnerability in Mozilla Firefox, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Weakness: CWE-416
Which versions are affected by CVE-2026-16351?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2026-16351?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-16351 being exploited?
There is no known exploitation of CVE-2026-16351 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2026-16351, GHSA-frvf-6637-jq2q, UBUNTU-CVE-2026-16351.