External risk intelligence

Firefox Disability Access APIs Use-After-Free Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16352

This vulnerability exists within the Disability Access APIs component of a web browser. It is a client-side component intended for local assistive technology integration and is not a network-facing service, edge gateway, or externally reachable application.

Use After Free

Mozilla Firefox

before 115.38.0before 153.0.0128.1.0 to before 140.13.0before 140.13.0141.0 to before 153.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in a browser component that could allow an attacker to escape a restricted environment. While the issue affects the Disability Access APIs, the primary concern for leadership is to confirm whether this specific technology is utilized within the organization's systems.

Browser flaw allows code to escape sandbox.
Confirm if Disability Access APIs are used.
Assess potential exposure of internal systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into visiting a malicious website. This website would then interact with the browser's Disability Access APIs, triggering a use-after-free condition within the component. If successful, this could allow the attacker to escape the browser's sandbox.

No authentication or user interaction required.
Malicious website triggers API use-after-free.
Sandbox escape to compromise the system.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Disability Access APIs component could allow an attacker to escape the browser's sandbox. This could potentially impact the integrity and confidentiality of system data when supported by the advisory.

System data integrity and confidentiality.
Exploitation via malicious web content.
Compromised system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical sandbox escape vulnerability in the Disability Access APIs component likely impacts end-user workstations and potentially any systems running the affected browser. The first practical step is to identify all instances of the affected browser, confirm their exposure and business criticality, and then coordinate remediation with the teams responsible for endpoint management and browser deployment, likely the Infrastructure or End-User Computing teams.

Confirm end-user computing team ownership.
Verify browser reachability and business criticality.
Plan targeted updates and user communication.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Disability Access APIs component in Firefox?

These APIs are internal browser tools that help integrate assistive technologies—such as screen readers or alternative input devices—with the Firefox interface. They allow software to query and manipulate UI elements so that users with disabilities can navigate the web. Because they interface between the browser's core and the operating system's accessibility framework, they manage sensitive memory processes to track screen content.

What does a use-after-free weakness mean for CVE-2026-16352?

This is a memory management error categorized as CWE-416. It occurs when the browser continues to reference a memory location after that memory has been freed or deleted. An attacker can exploit this by forcing the browser to access that dangling pointer, potentially overwriting data or executing arbitrary code. In this specific case, it breaks the browser's sandbox security boundary.

How does an attacker trigger this sandbox escape?

An attacker triggers this by luring a user to a specially crafted malicious website. The vulnerability resides in how the browser's accessibility component processes certain web content; simply navigating to the site allows the exploit to interact with the API. Note that the flaw is triggered by the browser's internal processing of web data, not by legitimate user interaction with screen-reading or assistive technology software.

Is my system at risk if I run Firefox?

According to Halo Surface Signal, this vulnerability is classified as 'very unlikely' to be exploited via network-facing services. While the browser is an internet-facing application, this specific flaw exists in a client-side component meant for local integration. It is not an external network service or edge gateway, meaning the primary risk is isolated to end-user workstations rather than server infrastructure.

What should I do first to address this threat?

The most effective first step is to prioritize updating all instances of Firefox to the fixed versions listed in the security advisory: Firefox 153, Firefox ESR 115.38, or Firefox ESR 140.13. Coordinate with your IT or end-user computing teams to verify that these patches are deployed across your organization's workstation fleet, as this is primarily an endpoint-focused security concern.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.