by Kastro
Paper/Archive/CVE-2026-8953

CVE-2026-8953

Mozilla Firefox — Sandbox escape due to use-after-free in the Disability Access APIs component

EPSS 0.5%CVSS 9.6
critical.is priorityof 100
38
CVSS 9.6 (ADP)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 45.0.450 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory115.36CNA
Thunderbirdsee advisory140.11CNA

Scores by source

CISA ADP9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2029511refmozilla.org/security/advisories/mfsa2026-46refmozilla.org/security/advisories/mfsa2026-47refmozilla.org/security/advisories/mfsa2026-48refmozilla.org/security/advisories/mfsa2026-50refmozilla.org/security/advisories/mfsa2026-51